CVE-2024-56749: 
Linux Kernel vulnerability analysis and mitigation

In the Linux kernel, a vulnerability (CVE-2024-56749) was discovered in the DLM (Distributed Lock Manager) component. The issue involves a reference counting error in the dlm_recover_members function. This vulnerability affects Linux kernel versions from 6.10 up to (excluding) 6.11.11 and versions from 6.12 up to (excluding) 6.12.2 (NVD).

The vulnerability occurs when dlm_recover_members() fails, where the references of the previously created root_list that holds and keeps all rsbs alive during recovery are not properly dropped. This scenario can happen when ping_members() encounters an -EINTR error due to another recovery progress being triggered (Kernel Patch). The vulnerability has been assigned a CVSS v3.1 Base Score of 5.5 MEDIUM (Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) (NVD).

The vulnerability can lead to a reference counting error in the Linux kernel's Distributed Lock Manager component, potentially causing memory leaks or system instability when recovery operations fail (NVD).

The vulnerability requires local access with low privileges to exploit. No known exploits in the wild have been reported at this time (NVD).

The vulnerability has been fixed in the Linux kernel through a patch that corrects the reference counting behavior by properly handling the error case in dlm_recover_members(). Users should upgrade to Linux kernel version 6.11.11 or 6.12.2 or later versions that include the fix (Kernel Patch).