Executive Summary

This vulnerability is a double-free issue in the Linux kernel's netdev component, specifically in the function netdev_nl_bind_rx_doit().

The problem arises because the function genlmsg_reply() always consumes the skb (socket buffer), but the error handling path also calls nlmsg_free(rsp), leading to a double-free scenario.

The fix involves not unbinding and instead propagating the error to the user, which is the typical way to handle genlmsg_reply() failures.

Such failures usually occur only if the user does something unusual, like calling the kernel with an already-full receive buffer.

Useful 0 Not Useful 0

Impact Analysis

A double-free vulnerability in the kernel can potentially lead to system instability, crashes, or security issues such as memory corruption.

However, this specific vulnerability is triggered only under unusual conditions, such as when the user calls the kernel with an already-full receive buffer.

If exploited, it could cause denial of service or potentially allow an attacker to execute arbitrary code with kernel privileges.

Useful 0 Not Useful 0