Security readout for executives and security teams
Plain-English summary
An error path in Linux network socket creation can leave a pointer to memory that has already been freed. Later kernel use of that pointer could let a low-privileged local attacker crash the system or potentially compromise data and system integrity. The supplied rating is CVSS 7.8 (high); the sources do not establish active exploitation.
Executive priority
Treat this as a high-priority kernel maintenance issue, especially on shared or multi-user Linux systems. It is not supported as an internet-remote emergency, but successful local exploitation could have severe business impact. Remediate within the normal high-severity window and accelerate where untrusted users or workloads have local execution.
Technical view
sock_init_data() attaches an allocated sk object to a sock object. If inet_create() subsequently fails, it frees sk without clearing the sock reference, creating a possible use-after-free. The stable-kernel fix clears the pointer on this error path. Potential impact is high across confidentiality, integrity, and availability.
Likely exposure
Exposure is limited to Linux systems running affected kernel builds and reachable by a low-privileged local user or process. The bundle lists Linux 2.6.12 and several 5.x and 6.x versions as affected. Exact distribution package status requires vendor confirmation because vendors may backport fixes without changing upstream-style version numbers.
Exploitation context
CVSS indicates local access, low complexity, low privileges, and no user interaction. KEV is false, and the supplied sources provide no evidence of in-the-wild exploitation or a public exploit. Trigger requirements beyond encountering the failing inet_create() path are not documented in the bundle.
Researcher notes
This is CWE-416. The corrected behavior clears the sock object's sk pointer after freeing sk during an inet_create() failure. Seven stable-kernel commits indicate branch-specific fixes. The bundle does not document precise failure prerequisites, distribution package mappings, proof-of-concept availability, or observed exploitation.
Mitigation direction
- Identify running Linux kernel builds and compare them with vendor advisories for CVE-2024-56601.
- Deploy a vendor-supported kernel containing the applicable stable fix.
- Follow required reboot or activation procedures so systems actually run the remediated kernel.
- Until patched, reduce unnecessary low-privilege local access on higher-risk multi-user systems.
Validation and detection
- Verify the running kernel, not only the installed package, is the remediated build.
- Confirm the vendor build includes the inet_create() fix or its documented backport.
- Retest relevant socket-creation workloads after deployment.
- Monitor patched systems for kernel faults or regressions through normal operational telemetry.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-416: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2024-56601 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/f8a3f255f7509a209292871715cda03779640c8dCVE reference, Linux
- https://git.kernel.org/stable/c/2bc34d8c8898ae9fddf4612501aabb22d76c2b2cCVE reference, Linux
- https://git.kernel.org/stable/c/3e8258070b0f2aba66b3ef18883de229674fb288CVE reference, Linux
- https://git.kernel.org/stable/c/b4513cfd3a10c03c660d5d3d26c2e322efbfdd9bCVE reference, Linux
- https://git.kernel.org/stable/c/25447c6aaa7235f155292b0c58a067347e8ae891CVE reference, Linux
- https://git.kernel.org/stable/c/691d6d816f93b2a1008c14178399061466e674efCVE reference, Linux
- https://git.kernel.org/stable/c/9365fa510c6f82e3aa550a09d0c5c6b44dbc78ffCVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/03/msg00001.htmlCVE reference, CVE
- https://lists.debian.org/debian-lts-announce/2025/03/msg00002.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Use After Free
Use After Free represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.