CVE-2024-26725

Summary

CVE-2024-26725 is a Linux kernel vulnerability affecting the netlink dump operation. A deadlock warning occurs during dpll pin dump due to a circular locking dependency between two mutexes, dpll_lock and nlk_cb_mutex-GENERIC. The issue arises when __netlink_dump_start() holds nlk->cb_mutex and calls a function that takes dpll_lock, while nlk->cb_mutex is released and taken again in netlink_dump(). This results in an ABBA deadlock. The fix involves moving the dpll_lock taking into the dumpit() callback to ensure proper lock taking order.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.