CVE-2024-26864: 
Linux Kernel vulnerability analysis and mitigation

A vulnerability in the Linux kernel's TCP implementation was discovered and fixed in March 2024, identified as CVE-2024-26864. The issue involves incorrect reference count handling in the __inet_hash_connect() function, which could lead to reference count underflow and socket leakage. This vulnerability affects the networking stack in the Linux kernel (Kernel Git).

The vulnerability stems from improper reference count handling when unhashing a socket from ehash during connection establishment. The issue was introduced by commit 66b60b0c8c4a which attempted to fix an unconnected socket occupying an ehash entry when bhash2 allocation fails. The fix requires using __sk_nulls_del_node_init_rcu() instead of sk_nulls_del_node_init_rcu() to properly revert changes done by check_established(), as the latter does not hold refcnt when inserting socket into ehash (Kernel Git).

The vulnerability can cause a reference count underflow and socket leakage in the Linux kernel's networking stack. This could potentially lead to resource exhaustion and system instability (CISA ADP).

The vulnerability was discovered through automated testing by syzbot, which reported a warning in sk_nulls_del_node_init_rcu(). The issue requires specific conditions during socket connection establishment to trigger the reference count handling problem (Kernel Git).

The vulnerability has been patched in the Linux kernel by modifying the __inet_hash_connect() function to use __sk_nulls_del_node_init_rcu() instead of sk_nulls_del_node_init_rcu(). System administrators should update their Linux kernel to a version containing this fix (Kernel Git).