{"id":"CVE-2024-41006","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetrom: Fix a memory leak in nr_heartbeat_expiry()\n\nsyzbot reported a memory leak in nr_create() [0].\n\nCommit 409db27e3a2e (\"netrom: Fix use-after-free of a listening s…","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetrom: Fix a memory leak in nr_heartbeat_expiry()\n\nsyzbot reported a memory leak in nr_create() [0].\n\nCommit 409db27e3a2e (\"netrom: Fix use-after-free of a listening s…","severity":"medium","cvss":5.5,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","cwe":["CWE-401"],"vendor":"linux","product":"linux_kernel","affected":["linux_kernel >= 4.19.272, < 4.19.317","linux_kernel >= 5.4.231, < 5.4.279","linux_kernel >= 5.10.166, < 5.10.221","linux_kernel >= 5.15.91, < 5.15.162","linux_kernel >= 6.1.9, < 6.1.96","linux_kernel >= 6.2, < 6.6.36","linux_kernel >= 6.7, < 6.9.7","linux_kernel = 6.10"],"patched":["linux_kernel 6.9.7"],"published":"2024-07-12","updated":"2026-10-15","sourceUpdated":"2026-10-15T01:18:41.177","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2024-41006","references":[{"url":"https://git.kernel.org/stable/c/0b9130247f3b6a1122478471ff0e014ea96bb735","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/280cf1173726a7059b628c610c71050d5c0b6937","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5391f9db2cab5ef1cb411be1ab7dbec728078fba","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a02fd5d775cf9787ee7698c797e20f2fa13d2e2b","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b6ebe4fed73eedeb73f4540f8edc4871945474c8","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d377f5a28332954b19e373d36823e59830ab1712","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d616876256b38ecf9a1a1c7d674192c5346bc69c","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e07a9c2a850cdebf625e7a1b8171bd23a8554313","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/0b9130247f3b6a1122478471ff0e014ea96bb735","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://git.kernel.org/stable/c/280cf1173726a7059b628c610c71050d5c0b6937","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://git.kernel.org/stable/c/5391f9db2cab5ef1cb411be1ab7dbec728078fba","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://git.kernel.org/stable/c/a02fd5d775cf9787ee7698c797e20f2fa13d2e2b","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://git.kernel.org/stable/c/b6ebe4fed73eedeb73f4540f8edc4871945474c8","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://git.kernel.org/stable/c/d377f5a28332954b19e373d36823e59830ab1712","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://git.kernel.org/stable/c/d616876256b38ecf9a1a1c7d674192c5346bc69c","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://git.kernel.org/stable/c/e07a9c2a850cdebf625e7a1b8171bd23a8554313","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-265688.html","label":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-355557.html","label":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-613116.html","label":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"tags":["nvd","cve.org"],"epss":0.00242,"epssPercentile":0.15338,"ingestedAt":"2026-10-15T03:30:12.726Z","ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2024-09-10T17:00:58.734577Z"},"slug":"CVE-2024-41006","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnetrom: Fix a memory leak in nr_heartbeat_expiry()\n\nsyzbot reported a memory leak in nr_create() [0].\n\nCommit 409db27e3a2e (\"netrom: Fix use-after-free of a listening socket.\")\nadded sock_hold() to the nr_heartbeat_expiry() function, where\na) a socket has a SOCK_DESTROY flag or\nb) a listening socket has a SOCK_DEAD flag.\n\nBut in the case \"a,\" when the SOCK_DESTROY flag is set, the file descriptor\nhas already been closed and the nr_release() function has been called.\nSo it makes no sense to hold the reference count because no one will\ncall another nr_destroy_socket() and put it as in the case \"b.\"\n\nnr_connect\n  nr_establish_data_link\n    nr_start_heartbeat\n\nnr_release\n  switch (nr->state)\n  case NR_STATE_3\n    nr->state = NR_STATE_2\n    sock_set_flag(sk, SOCK_DESTROY);\n\n                        nr_rx_frame\n                          nr_process_rx_frame\n                            switch (nr->state)\n                            case NR_STATE_2\n                              nr_state2_machine()\n                                nr_disconnect()\n                                  nr_sk(sk)->state = NR_STATE_0\n                                  sock_set_flag(sk, SOCK_DEAD)\n\n                        nr_heartbeat_expiry\n                          switch (nr->state)\n                          case NR_STATE_0\n                            if (sock_flag(sk, SOCK_DESTROY) ||\n                               (sk->sk_state == TCP_LISTEN\n                                 && sock_flag(sk, SOCK_DEAD)))\n                               sock_hold()  // ( !!! )\n                               nr_destroy_socket()\n\nTo fix the memory leak, let's call sock_hold() only for a listening socket.\n\nFound by InfoTeCS on behalf of Linux Verification Center\n(linuxtesting.org) with Syzkaller.\n\n[0]: https://syzkaller.appspot.com/bug?extid=d327a1f3b12e1e206c16\n\n## Affected\n\n- `linux_kernel >= 4.19.272, < 4.19.317`\n- `linux_kernel >= 5.4.231, < 5.4.279`\n- `linux_kernel >= 5.10.166, < 5.10.221`\n- `linux_kernel >= 5.15.91, < 5.15.162`\n- `linux_kernel >= 6.1.9, < 6.1.96`\n- `linux_kernel >= 6.2, < 6.6.36`\n- `linux_kernel >= 6.7, < 6.9.7`\n- `linux_kernel = 6.10`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `linux_kernel 6.9.7`","depth":"sunlit","depthScore":30,"depthScoreParts":{"impact":30.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}