CVE-2024-50261

Summary

CVE-2024-50261 is a Linux kernel vulnerability affecting the macsec subsystem. The issue involves a use-after-free condition, where the metadata_dst is freed by metadata_dst_free() in macsec_free_netdev(), but the driver continues to use it for sending packets. This results in a kernel crash, as reported by KASAN. The kernel now uses dst_release() instead of instantaneously freeing metadata_dst if it's still referenced by skb to prevent this issue. The vulnerability was identified by KASAN during the execution of mlx5e_xmit, with the call stack tracing back to mld_sendpack and mld_ifc_work. The affected memory was allocated by task 3922 and freed by task 4011.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.