Threats tagged 'ghsa-g37m-wg3j-xw8v'

CVE-2024-41040 is a use-after-free (UAF) vulnerability in the Linux kernel's network scheduler (net/sched) subsystem. The flaw occurs when resolving a clash in connection tracking, where a connection tracking object (ct) may be freed but still accessed later, leading to a use-after-free condition. This issue has been identified and fixed by ensuring the ct is re-retrieved from the socket buffer after confirming connection tracking. The vulnerability has a high severity with a CVSS score of 7.0, indicating potential for significant impact on confidentiality, integrity, and availability if exploited.