What’s Vulnerable › Vulnerabilities

CVE-2024-46855: netfilter: nft_socket: fix sk refcount leaks

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-09-27 · updated 2026-08-04

Description

In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_socket: fix sk refcount leaks We must put 'sk' reference before returning.

Affected products

• Linux kernel: from 5.3 before 6.1.111; from 6.2 before 6.6.52; from 6.7 before 6.10.11; 4.19.76, 5.2.18, 6.11-rc1, 6.11-rc2, 6.11-rc3, 6.11-rc4 (+3) — fixed in 6.1.111, 6.10.11, 6.6.52

How to fix

Upgrade to a fixed version: Linux kernel 6.1.111, 6.10.11, 6.6.52. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/076d281e90aaf4192799ecb9a1ed82321e133ecd
• https://git.kernel.org/stable/c/1f68e097e20d3c695281a9c6433acc37be47fe11
• https://git.kernel.org/stable/c/33c2258bf8cb17fba9e58b111d4c4f4cf43a4896
• https://git.kernel.org/stable/c/6572440f78b724c46070841a68254ebc534cde24
• https://git.kernel.org/stable/c/83e6fb59040e8964888afcaa5612cc1243736715
• https://git.kernel.org/stable/c/8b26ff7af8c32cb4148b3e147c52f9e4c695209c
• https://git.kernel.org/stable/c/ddc7c423c4a5386bf865474c694b48178efd311a
• https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html
• https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html

Get alerted when CVE-2024-46855 or the next vulnerability affects your stack