{"id":"DEBIAN-CVE-2024-26782","details":"In the Linux kernel, the following vulnerability has been resolved:  mptcp: fix double-free on socket dismantle  when MPTCP server accepts an incoming connection, it clones its listener socket. However, the pointer to 'inet_opt' for the new socket has the same value as the original one: as a consequence, on program exit it's possible to observe the following splat:    BUG: KASAN: double-free in inet_sock_destruct+0x54f/0x8b0   Free of addr ffff888485950880 by task swapper/25/0    CPU: 25 PID: 0 Comm: swapper/25 Kdump: loaded Not tainted 6.8.0-rc1+ #609   Hardware name: Supermicro SYS-6027R-72RF/X9DRH-7TF/7F/iTF/iF, BIOS 3.0  07/26/2013   Call Trace:    \u003cIRQ\u003e    dump_stack_lvl+0x32/0x50    print_report+0xca/0x620    kasan_report_invalid_free+0x64/0x90    __kasan_slab_free+0x1aa/0x1f0    kfree+0xed/0x2e0    inet_sock_destruct+0x54f/0x8b0    __sk_destruct+0x48/0x5b0    rcu_do_batch+0x34e/0xd90    rcu_core+0x559/0xac0    __do_softirq+0x183/0x5a4    irq_exit_rcu+0x12d/0x170    sysvec_apic_timer_interrupt+0x6b/0x80    \u003c/IRQ\u003e    \u003cTASK\u003e    asm_sysvec_apic_timer_interrupt+0x16/0x20   RIP: 0010:cpuidle_enter_state+0x175/0x300   Code: 30 00 0f 84 1f 01 00 00 83 e8 01 83 f8 ff 75 e5 48 83 c4 18 44 89 e8 5b 5d 41 5c 41 5d 41 5e 41 5f c3 cc cc cc cc fb 45 85 ed \u003c0f\u003e 89 60 ff ff ff 48 c1 e5 06 48 c7 43 18 00 00 00 00 48 83 44 2b   RSP: 0018:ffff888481cf7d90 EFLAGS: 00000202   RAX: 0000000000000000 RBX: ffff88887facddc8 RCX: 0000000000000000   RDX: 1ffff1110ff588b1 RSI: 0000000000000019 RDI: ffff88887fac4588   RBP: 0000000000000004 R08: 0000000000000002 R09: 0000000000043080   R10: 0009b02ea273363f R11: ffff88887fabf42b R12: ffffffff932592e0   R13: 0000000000000004 R14: 0000000000000000 R15: 00000022c880ec80    cpuidle_enter+0x4a/0xa0    do_idle+0x310/0x410    cpu_startup_entry+0x51/0x60    start_secondary+0x211/0x270    secondary_startup_64_no_verify+0x184/0x18b    \u003c/TASK\u003e    Allocated by task 6853:    kasan_save_stack+0x1c/0x40    kasan_save_track+0x10/0x30    __kasan_kmalloc+0xa6/0xb0    __kmalloc+0x1eb/0x450    cipso_v4_sock_setattr+0x96/0x360    netlbl_sock_setattr+0x132/0x1f0    selinux_netlbl_socket_post_create+0x6c/0x110    selinux_socket_post_create+0x37b/0x7f0    security_socket_post_create+0x63/0xb0    __sock_create+0x305/0x450    __sys_socket_create.part.23+0xbd/0x130    __sys_socket+0x37/0xb0    __x64_sys_socket+0x6f/0xb0    do_syscall_64+0x83/0x160    entry_SYSCALL_64_after_hwframe+0x6e/0x76    Freed by task 6858:    kasan_save_stack+0x1c/0x40    kasan_save_track+0x10/0x30    kasan_save_free_info+0x3b/0x60    __kasan_slab_free+0x12c/0x1f0    kfree+0xed/0x2e0    inet_sock_destruct+0x54f/0x8b0    __sk_destruct+0x48/0x5b0    subflow_ulp_release+0x1f0/0x250    tcp_cleanup_ulp+0x6e/0x110    tcp_v4_destroy_sock+0x5a/0x3a0    inet_csk_destroy_sock+0x135/0x390    tcp_fin+0x416/0x5c0    tcp_data_queue+0x1bc8/0x4310    tcp_rcv_state_process+0x15a3/0x47b0    tcp_v4_do_rcv+0x2c1/0x990    tcp_v4_rcv+0x41fb/0x5ed0    ip_protocol_deliver_rcu+0x6d/0x9f0    ip_local_deliver_finish+0x278/0x360    ip_local_deliver+0x182/0x2c0    ip_rcv+0xb5/0x1c0    __netif_receive_skb_one_core+0x16e/0x1b0    process_backlog+0x1e3/0x650    __napi_poll+0xa6/0x500    net_rx_action+0x740/0xbb0    __do_softirq+0x183/0x5a4    The buggy address belongs to the object at ffff888485950880    which belongs to the cache kmalloc-64 of size 64   The buggy address is located 0 bytes inside of    64-byte region [ffff888485950880, ffff8884859508c0)    The buggy address belongs to the physical page:   page:0000000056d1e95e refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888485950700 pfn:0x485950   flags: 0x57ffffc0000800(slab|node=1|zone=2|lastcpupid=0x1fffff)   page_type: 0xffffffff()   raw: 0057ffffc0000800 ffff88810004c640 ffffea00121b8ac0 dead000000000006   raw: ffff888485950700 0000000000200019 00000001ffffffff 0000000000000000   page dumped because: kasan: bad access detected    Memory state around the buggy address:    ffff888485950780: fa fb fb ---truncated---","modified":"2026-09-15T09:03:05.307755615Z","published":"2024-04-04T09:15:08.020Z","upstream":["CVE-2024-26782"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2024-26782"}],"affected":[{"package":{"name":"linux","ecosystem":"Debian:12","purl":"pkg:deb/debian/linux?arch=source&distro=bookworm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.82-1"}]}],"versions":["6.1.27-1","6.1.37-1","6.1.38-1","6.1.38-2","6.1.38-2~bpo11+1","6.1.38-3","6.1.38-4","6.1.38-4~bpo11+1","6.1.52-1","6.1.55-1","6.1.55-1~bpo11+1","6.1.64-1","6.1.66-1","6.1.67-1","6.1.69-1","6.1.69-1~bpo11+1","6.1.76-1","6.1.76-1~bpo11+1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2024-26782.json"}},{"package":{"name":"linux","ecosystem":"Debian:13","purl":"pkg:deb/debian/linux?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.7.9-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2024-26782.json"}},{"package":{"name":"linux","ecosystem":"Debian:14","purl":"pkg:deb/debian/linux?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.7.9-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2024-26782.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}