CVE-2024-50260: 
Linux Debian vulnerability analysis and mitigation

CVE-2024-50260 affects the Linux kernel's sock_map functionality. The vulnerability involves a NULL pointer dereference in the sock_map_link_update_prog() function due to a race condition. This issue was discovered and reported in November 2024, affecting Linux kernel versions from 6.10 up to (excluding) 6.11.7, as well as version 6.12 release candidates (rc1-rc5) (NVD).

The vulnerability stems from a race condition in the sock_map_link_update_prog() function where a NULL pointer dereference can occur. The race condition manifests when sock_map_link_detach() sets sockmap_link->map to NULL after releasing the sockmap_mutex, followed by sock_map_link_update_prog() attempting to use the now-NULL pointer. The issue has been assigned a CVSS v3.1 base score of 4.7 (Medium), with the vector string CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H (NVD, Kernel Patch).

When successfully exploited, this vulnerability can lead to a system crash (denial of service) through a NULL pointer dereference in the kernel's sock_map functionality (NVD).

The vulnerability has been fixed by adding a NULL pointer check in the sock_map_link_update_prog() function. The fix prevents updating a link that is being released. The patch has been incorporated into Linux kernel version 6.11.7 and later releases (Kernel Patch).