CVE-2024-56372: 
Linux Kernel vulnerability analysis and mitigation

CVE-2024-56372 is a vulnerability in the Linux kernel's TUN (network tunnel) driver, specifically in the tun_napi_alloc_frags() function. The vulnerability was discovered and reported by syzbot on January 11, 2025. The issue affects the Linux kernel's networking stack, particularly the TUN driver implementation (NVD).

The vulnerability stems from an incorrect handling of IOV components in the tun_napi_alloc_frags() function. Instead of properly iterating through all IOV components, the function keeps using only the first one, resulting in a malformed socket buffer (skb). This leads to a kernel BUG at net/core/skbuff.c:2849, causing an invalid opcode crash. The issue was introduced with the commit that added the iter_iovec() helper (Kernel Commit).

When exploited, this vulnerability causes a kernel crash, triggering an invalid opcode exception. This can lead to system instability and potential denial of service conditions in affected Linux systems (NVD).

A fix has been developed and committed to the Linux kernel. The patch modifies the tun_napi_alloc_frags() function to correctly handle IOV components by properly incrementing the IOV pointer (iov = iter_iov(it) + i). The fix has been reviewed and accepted by multiple kernel maintainers (Kernel Commit).