VYPR
← All advisories
Medium severity5.5NVD Advisory· Published Oct 21, 2024· Updated May 12, 2026

CVE-2024-49944

CVE-2024-49944

Description

In the Linux kernel, the following vulnerability has been resolved:

sctp: set sk_state back to CLOSED if autobind fails in sctp_listen_start

In sctp_listen_start() invoked by sctp_inet_listen(), it should set the sk_state back to CLOSED if sctp_autobind() fails due to whatever reason.

Otherwise, next time when calling sctp_inet_listen(), if sctp_sk(sk)->reuse is already set via setsockopt(SCTP_REUSE_PORT), sctp_sk(sk)->bind_hash will be dereferenced as sk_state is LISTENING, which causes a crash as bind_hash is NULL.

KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] RIP: 0010:sctp_inet_listen+0x7f0/0xa20 net/sctp/socket.c:8617 Call Trace:

__sys_listen_socket net/socket.c:1883 [inline] __sys_listen+0x1b7/0x230 net/socket.c:1894 __do_sys_listen net/socket.c:1902 [inline]

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

In the Linux kernel, a missing state reset in SCTP listen allows NULL pointer dereference, leading to a potential crash.

Vulnerability

Analysis

The vulnerability resides in the Linux kernel's SCTP implementation, specifically in the sctp_listen_start function. When sctp_autobind() fails, the socket state sk_state is not reset to CLOSED. This leaves the socket in a LISTENING state with a NULL bind_hash pointer. On a subsequent call to sctp_inet_listen() with SCTP_REUSE_PORT set, the kernel dereferences the NULL bind_hash, causing a null-pointer dereference and system crash [1].

Exploitation

An attacker must have the ability to invoke listen() on an SCTP socket and trigger a failure of sctp_autobind(). This typically requires local access to the system with low privileges. The attack surface is local, and no network access is needed aside from local socket operations [1].

Impact

Successful exploitation results in a kernel crash (denial of service). The CVSS v3.1 base score is 5.5 (Medium), indicating a moderate impact on availability with low attack complexity and low privileges required [1].

Mitigation

The fix has been committed to the Linux kernel stable trees. Patches are available in commits [3] and [4] for different stable kernel versions. Users should update their kernels to the latest patched versions. Siemens has also released a security advisory [1] listing affected products, including the SIMATIC S7-1500 TM MFP - GNU/Linux subsystem, which is impacted by this CVE.

References
  1. SSA-265688
  2. Making sure you're not a bot!
  3. Making sure you're not a bot!

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

114

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

13

News mentions

0

No linked articles in our index yet.