CVE-2024-56645
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
In the Linux kernel, in the CAN subsystem (J1939), there is a reference counting bug in the j1939_session_new() function. The j1939_session_skb_queue() function performs an extra skb_get() for each new skb, but it does not do so for the initial one, leading to a refcount underflow.
Risk Assessment
This can lead to incorrect memory freeing, system crashes, or potential exploitation for privilege escalation in systems using the J1939 protocol.
Recommendation
It is recommended to update the Linux kernel to a version with the fix that adds the appropriate skb_get() for the initial skb in j1939_session_new().
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: can: j1939: j1939_session_new(): fix skb reference counting Since j1939_session_skb_queue() does an extra skb_get() for each new skb, do the same for the initial one in j1939_session_new() to avoid refcount underflow. [mkl: clean up commit message]