CVE-2024-50212: 
Linux Debian vulnerability analysis and mitigation

A vulnerability in the Linux kernel was identified and resolved, affecting the alloctagmoduleunload functionality. The issue was discovered when the nfnat module's exit calls kfreercu on certain addresses, but the free operation remains pending when alloctag checks for leaks. The vulnerability was reported by Ben Greear and was fixed in November 2024 (Kernel Git).

The vulnerability occurs in the module unloading process where kfreercu operations are not properly synchronized. When the nfnat module is unloaded, it calls kfreercu on addresses, but the alloctagmoduleunload function checks for leaks before these operations complete. This results in a warning at lib/alloc_tag.c:168. The issue can be reproduced by executing a sequence of commands involving iptables-nft and module unloading (Kernel Git).

The vulnerability can trigger kernel warnings and potentially lead to memory leak detection issues during module unloading. This affects the kernel's memory management system and module handling capabilities (NVD).

The issue has been fixed by adding a kvfreercubarrier() call before checking for leaks in the module unload process. This ensures that all pending kfree_rcu operations complete before the leak check is performed (Kernel Git).