Reference Leak Vulnerability in Linux Kernel - Debian Packages
Summary
DEBIAN-CVE-2024-50166: In the Linux kernel, the following vulnerability has been resolved: fsl/fman: Fix refcount handling of fman-related devices In mac_probe() there are multiple calls to of_find_device_by_node(), fman_bind() and fman_port_b... Affects linux versions < 6.11.6-1. Fixed in 6.11.6-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Linux operating system, responsible for managing system resources and hardware communication. It provides essential services for all other parts of the operating system. The kernel is modular, allowing for various functionalities to be added or removed as needed. This vulnerability affects Debian versions 13 and 14 of the Linux package, specifically related to the handling of reference counts for fman-related devices.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the mac_probe() function, where multiple calls to of_find_device_by_node(), fman_bind(), and fman_port_bind() take references to the device. However, not all references are released on error paths in both mac_probe() and mac_remove(), leading to potential reference leaks. This could result in resource exhaustion or system instability over time as the leaked references accumulate.
How To Fix
Minimum fixed version
6.11.6-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the patch as soon as it is available.
Conclusion
The identified vulnerability in the Linux kernel poses a risk due to reference leaks that can lead to resource exhaustion. Users of Debian versions 13 and 14 should promptly update to the patched version 6.11.6-1 to mitigate this risk. Regular monitoring and timely updates are essential for maintaining system security.
See every vulnerability recorded for linux →
FAQ
The vulnerability involves reference leaks in the Linux kernel related to fman-related devices, which can lead to resource exhaustion.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Check your application against the vulnerability using the Vulert playground.
Debian versions 13 and 14 are affected by this vulnerability.
Yes, a patch is available in version 6.11.6-1 of the Linux package.
While there are no specific workarounds, it is advisable to monitor your system for unusual behavior until you can apply the patch.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
