CVE-2024-27418: 
Linux Kernel vulnerability analysis and mitigation

A memory leak vulnerability was discovered in the Linux kernel's MCTP (Management Component Transport Protocol) implementation, specifically in the mctp_local_output function. The vulnerability was disclosed on May 17, 2024, and assigned identifier CVE-2024-27418. The issue occurs because mctp_local_output only takes ownership of skb (socket buffer) on success, potentially leading to memory leaks if the function fails in specific states (Kernel Git).

The vulnerability stems from a flaw in the socket buffer ownership handling within the mctp_local_output function. The skb ownership isn't transferred until the actual output routing occurs, which can result in memory leaks on error paths. The issue was introduced in commit 833ef3b91de6 ("mctp: Populate socket implementation") and has been fixed by ensuring mctp_local_output frees the skb on all error paths up to the route action, making it always consume the passed skb (Kernel Git).

The vulnerability could lead to memory leaks in the Linux kernel when the MCTP subsystem encounters specific error conditions during packet transmission. This can potentially result in system resource exhaustion over time (Kernel Git).

The vulnerability requires access to the MCTP subsystem and can be triggered through error conditions in the packet transmission path. No public exploits have been reported at the time of assessment (NVD).

The issue has been fixed in the Linux kernel through a patch that ensures proper skb cleanup on all error paths. The fix has been backported to multiple stable kernel versions. Users should update their kernel to a version containing the fix (Kernel Git).