High 7.8Published Dec 27, 2024

CVE-2024-56601net: inet: do not leave a dangling sk pointer in inet_create()

Updated under an hour ago (Oct 27, 2026, 10:40 PM ET)

Does this affect you?

It affects Linux and 7 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: net: inet: do not leave a dangling sk pointer in inet_create() sock_init_data() attaches the allocated sk object to the provided sock object. If inet_create() fails later, the sk object is freed, but the sock object retains the dangling pointer, which may create use-after-free later. Clear the sk pointer in the sock object on error.

CVSS: 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): CWE-416
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 14, 2026
First seen by InfoSec Signals: Oct 14, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before f8a3f255f7509a209292871715cda03779640c8d; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 2bc34d8c8898ae9fddf4612501aabb22d76c2b2c; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 3e8258070b0f2aba66b3ef18883de229674fb288; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before b4513cfd3a10c03c660d5d3d26c2e322efbfdd9b; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 25447c6aaa7235f155292b0c58a067347e8ae891; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 691d6d816f93b2a1008c14178399061466e674ef; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 9365fa510c6f82e3aa550a09d0c5c6b44dbc78ff	CNA record
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518_4_pn_dp_mfp (from the name)	from V3.1.0 before V3.1.5	CISA ADP
Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518f_4_pn_dp_mfp (from the name)	from V3.1.0 before V3.1.5	CISA ADP
Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP siemens:siplus_s7_1500_cpu_1518_4_pn_dp_mfp (from the name)	from V3.1.0 before V3.1.5	CISA ADP
Siemens RUGGEDCOM RST2428P siemens:ruggedcom_rst2428p (from the name)	before V3.2	CISA ADP
Siemens SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family siemens:scalance_xc_300_xr_300_xc_400_xr_500wg_xr_500_family (from the name)	before V3.2	CISA ADP
Siemens SCALANCE XCM-/XRM-/XCH-/XRH-300 family siemens:scalance_xcm_xrm_xch_xrh_300_family (from the name)	before V3.2	CISA ADP
linux linux_kernel linux:linux_kernel	before 5.4.287; from 5.5 before 5.10.231; from 5.11 before 5.15.174; from 5.16 before 6.1.120; from 6.2 before 6.6.66; from 6.7 before 6.12.5	NVD

References

References

https://git.kernel.org/stable/c/f8a3f255f7509a209292871715cda03779640c8d	patch
https://git.kernel.org/stable/c/2bc34d8c8898ae9fddf4612501aabb22d76c2b2c	patch
https://git.kernel.org/stable/c/3e8258070b0f2aba66b3ef18883de229674fb288	patch
https://git.kernel.org/stable/c/b4513cfd3a10c03c660d5d3d26c2e322efbfdd9b	patch
https://git.kernel.org/stable/c/25447c6aaa7235f155292b0c58a067347e8ae891	patch
https://git.kernel.org/stable/c/691d6d816f93b2a1008c14178399061466e674ef	patch
https://git.kernel.org/stable/c/9365fa510c6f82e3aa550a09d0c5c6b44dbc78ff	patch
https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html
https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html
https://cert-portal.siemens.com/productcert/html/ssa-355557.html
1–10 of 11

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.