net: fix memory leak in tcp_conn_request()
In the Linux kernel, the following vulnerability has been resolved: net: fix memory leak in tcp_conn_request() If inet_csk_reqsk_queue_hash_add() return false, tcp_conn_request() will return without free the dst memory, which allocated in af_ops->route_req. Here is the kmemleak stack: unreferenced object 0xffff8881198631c0 (size 240): comm "softirq", pid 0, jiffies 4299266571 (age 1802.392s) hex dump (first 32 bytes): 00 10 9b 03 81 88 ff ff 80 98 da bc ff ff ff ff ................ 81 55 18 bb ff ff ff ff 00 00 00 00 00 00 00 00 .U.............. backtrace: [] kmem_cache_alloc+0x60c/0xa80 [] dst_alloc+0x55/0x250 [] rt_dst_alloc+0x46/0x1d0 [] __mkroute_output+0x29a/0xa50 [] ip_route_output_key_hash+0x10b/0x240 [] ip_route_output_flow+0x1d/0x90 [] inet_csk_route_req+0x2c5/0x500 [] tcp_conn_request+0x691/0x12c0 [] tcp_rcv_state_process+0x3c8/0x11b0 [] tcp_v4_do_rcv+0x156/0x3b0 [] tcp_v4_rcv+0x1cf8/0x1d80 [] ip_protocol_deliver_rcu+0xf6/0x360 [] ip_local_deliver_finish+0xe6/0x1e0 [] ip_local_deliver+0xee/0x360 [] ip_rcv+0xad/0x2f0 [] __netif_receive_skb_one_core+0x123/0x140 Call dst_release() to free the dst memory when inet_csk_reqsk_queue_hash_add() return false in tcp_conn_request().
- Products
- Kernel
- Affected versions
- Not specified
- Fixed versions
- 5.15.176, 6.1.124, 6.12.9, 6.6.70
- CVEs
- CVE-2024-57841
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 6 Nov 2026, 02:53 UTC · Revision 1
Source evidence
net: fix memory leak in tcp_conn_request()
core-osv · Original sourcePublished 15 Jan 2025, 13:10 UTC
In the Linux kernel, the following vulnerability has been resolved: net: fix memory leak in tcp_conn_request() If inet_csk_reqsk_queue_hash_add() return false, tcp_conn_request() will return without free the dst memory, which allocated in af_ops->route_req. Here is the kmemleak stack: unreferenced object 0xffff8881198631c0 (size 240): comm "softirq", pid 0, jiffies 4299266571 (age 1802.392s) hex dump (first 32 bytes): 00 10 9b 03 81 88 ff ff 80 98 da bc ff ff ff ff ................ 81 55 18 bb ff ff ff ff 00 00 00 00 00 00 00 00 .U.............. backtrace: [] kmem_cache_alloc+0x60c/0xa80 [] dst_alloc+0x55/0x250 [] rt_dst_alloc+0x46/0x1d0 [] __mkroute_output+0x29a/0xa50 [] ip_route_output_key_hash+0x10b/0x240 [] ip_route_output_flow+0x1d/0x90 [] inet_csk_route_req+0x2c5/0x500 [] tcp_conn_request+0x691/0x12c0 [] tcp_rcv_state_process+0x3c8/0x11b0 [] tcp_v4_do_rcv+0x156/0x3b0 [] tcp_v4_rcv+0x1cf8/0x1d80 [] ip_protocol_deliver_rcu+0xf6/0x360 [] ip_local_deliver_finish+0xe6/0x1e0 [] ip_local_deliver+0xee/0x360 [] ip_rcv+0xad/0x2f0 [] __netif_receive_skb_one_core+0x123/0x140 Call dst_release() to free the dst memory when inet_csk_reqsk_queue_hash_add() return false in tcp_conn_request().
osv:CVE-2024-57841
Kernel
Fixed versions: 5.15.176, 6.1.124, 6.6.70, 6.12.9
Complete source record
{
"id": "08d2013a7bc3044036f1d170e35030230eb64d7b8e772daec617c9658f5eadd9",
"url": "https://osv.dev/vulnerability/CVE-2024-57841",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "net: fix memory leak in tcp_conn_request()",
"summary": "In the Linux kernel, the following vulnerability has been resolved: net: fix memory leak in tcp_conn_request() If inet_csk_reqsk_queue_hash_add() return false, tcp_conn_request() will return without free the dst memory, which allocated in af_ops->route_req. Here is the kmemleak stack: unreferenced object 0xffff8881198631c0 (size 240): comm \"softirq\", pid 0, jiffies 4299266571 (age 1802.392s) hex dump (first 32 bytes): 00 10 9b 03 81 88 ff ff 80 98 da bc ff ff ff ff ................ 81 55 18 bb ff ff ff ff 00 00 00 00 00 00 00 00 .U.............. backtrace: [] kmem_cache_alloc+0x60c/0xa80 [] dst_alloc+0x55/0x250 [] rt_dst_alloc+0x46/0x1d0 [] __mkroute_output+0x29a/0xa50 [] ip_route_output_key_hash+0x10b/0x240 [] ip_route_output_flow+0x1d/0x90 [] inet_csk_route_req+0x2c5/0x500 [] tcp_conn_request+0x691/0x12c0 [] tcp_rcv_state_process+0x3c8/0x11b0 [] tcp_v4_do_rcv+0x156/0x3b0 [] tcp_v4_rcv+0x1cf8/0x1d80 [] ip_protocol_deliver_rcu+0xf6/0x360 [] ip_local_deliver_finish+0xe6/0x1e0 [] ip_local_deliver+0xee/0x360 [] ip_rcv+0xad/0x2f0 [] __netif_receive_skb_one_core+0x123/0x140 Call dst_release() to free the dst memory when inet_csk_reqsk_queue_hash_add() return false in tcp_conn_request().",
"evidence": "osv:CVE-2024-57841",
"products": [
{
"name": {
"value": "Kernel",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "5.15.176",
"evidence": "/affected/1/ranges"
},
{
"value": "6.1.124",
"evidence": "/affected/1/ranges"
},
{
"value": "6.6.70",
"evidence": "/affected/1/ranges"
},
{
"value": "6.12.9",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
}
],
"severity": "medium",
"structured": {
"id": "CVE-2024-57841",
"aliases": [
"CVE-2024-57841"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "527bec1f56ac7a2fceb8eb77eb0fc2678ecba394"
},
{
"fixed": "9d38959677291552d1b0ed2689a540af279b5bf8"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "c14f3c3793f7a785763e353df7fc40426187f832"
},
{
"fixed": "de3f999bf8aee16e9da1c1224191abdc69e97c9d"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "fdae4d139f4778b20a40c60705c53f5f146459b5"
},
{
"fixed": "2af69905180b3fea12f9c1db374b153a06977021"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "ff46e3b4421923937b7f6e44ffcd3549a074f321"
},
{
"fixed": "b0b190218c78d8aeecfba36ea3a90063b3ede52d"
},
{
"fixed": "4f4aa4aa28142d53f8b06585c478476cfe325cfc"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "5.15.162"
},
{
"fixed": "5.15.176"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "6.1.97"
},
{
"fixed": "6.1.124"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "6.6.37"
},
{
"fixed": "6.6.70"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "6.9.8"
},
{
"fixed": "6.10"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "360892e60710427229fc1f7bb2218cf4d578229b"
}
]
}
],
"versions": [
"v5.15.175",
"v5.15.174",
"v5.15.173",
"v5.15.172",
"v5.15.171",
"v5.15.170",
"v5.15.169",
"v5.15.168",
"v5.15.167",
"v5.15.166",
"v5.15.165",
"v5.15.164",
"v5.15.163",
"v5.15.162",
"v6.1.123",
"v6.1.122",
"v6.1.121",
"v6.1.120",
"v6.1.119",
"v6.1.118",
"v6.1.117",
"v6.1.116",
"v6.1.115",
"v6.1.114",
"v6.1.113",
"v6.1.112",
"v6.1.111",
"v6.1.110",
"v6.1.109",
"v6.1.108",
"v6.1.107",
"v6.1.106",
"v6.1.105",
"v6.1.104",
"v6.1.103",
"v6.1.102",
"v6.1.101",
"v6.1.100",
"v6.1.99",
"v6.1.98",
"v6.1.97",
"v6.6.69",
"v6.6.68",
"v6.6.67",
"v6.6.66",
"v6.6.65",
"v6.6.64",
"v6.6.63",
"v6.6.62",
"v6.6.61",
"v6.6.60",
"v6.6.59",
"v6.6.58",
"v6.6.57",
"v6.6.56",
"v6.6.55",
"v6.6.54",
"v6.6.53",
"v6.6.52",
"v6.6.51",
"v6.6.50",
"v6.6.49",
"v6.6.48",
"v6.6.47",
"v6.6.46",
"v6.6.45",
"v6.6.44",
"v6.6.43",
"v6.6.42",
"v6.6.41",
"v6.6.40",
"v6.6.39",
"v6.6.38",
"v6.6.37",
"v6.9.12",
"v6.9.11",
"v6.9.10",
"v6.9.9",
"v6.9.8"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-57841.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "5.15.176"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "5.16.0"
},
{
"fixed": "6.1.124"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.2.0"
},
{
"fixed": "6.6.70"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.7.0"
},
{
"fixed": "6.12.9"
}
]
}
],
"package": {
"name": "Kernel",
"ecosystem": "Linux"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-57841.json"
}
}
],
"modified": "2026-10-28T02:30:46.614545399Z",
"provider": "osv",
"references": [
"https://git.kernel.org/stable/c/2af69905180b3fea12f9c1db374b153a06977021",
"https://git.kernel.org/stable/c/4f4aa4aa28142d53f8b06585c478476cfe325cfc",
"https://git.kernel.org/stable/c/9d38959677291552d1b0ed2689a540af279b5bf8",
"https://git.kernel.org/stable/c/b0b190218c78d8aeecfba36ea3a90063b3ede52d",
"https://git.kernel.org/stable/c/de3f999bf8aee16e9da1c1224191abdc69e97c9d",
"https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/57xxx/CVE-2024-57841.json",
"https://nvd.nist.gov/vuln/detail/CVE-2024-57841",
"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
],
"provider_metadata": {
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/57xxx/CVE-2024-57841.json"
}
},
"related_cves": [
{
"value": "CVE-2024-57841",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 514443,
"published_at": "2025-01-15T13:10:26.842+00:00"
}