CVE-2024-56637: 
Linux Kernel vulnerability analysis and mitigation

CVE-2024-56637 affects the Linux kernel's netfilter ipset module. The vulnerability was discovered and disclosed on December 27, 2024. The issue exists in the ip_set.ko module where user space may unload the module while it is requesting a set type backend module (NVD).

The vulnerability is a race condition in the Linux kernel's netfilter ipset module. Specifically, the issue occurs in the load_settype() function where there was no module reference being held while requesting a module. The race condition can be triggered by inserting an mdelay() right after the nfnl_unlock() call (Kernel Commit).

When exploited, this vulnerability leads to a kernel crash, resulting in a denial of service condition. The issue occurs when user space unloads ip_set.ko while it is requesting a set type backend module (NVD).

The issue has been fixed in the Linux kernel by adding proper module reference handling. The fix involves using try_module_get() and module_put() to ensure the module cannot be unloaded while requesting a backend module. The patch has been backported to various stable kernel versions (Debian Update).