In the Linux kernel, the following vulnerability has been resolved:
tipc: fix UAF in error path
Sam Page (sam4k) working with Trend Micro Zero Day Initiative reported a UAF in the tipcbufappend() error path:
BUG: KASAN: slab-use-after-free in kfreeskblist_reason+0x47e/0x4c0 linux/net/core/skbuff.c:1183 Read of size 8 at addr ffff88804d2a7c80 by task poc/8034
CPU: 1 PID: 8034 Comm: poc Not tainted 6.8.2 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.0-debian-1.16.0-5 04/01/2014 Call Trace: <IRQ> _dumpstack linux/lib/dumpstack.c:88 dumpstacklvl+0xd9/0x1b0 linux/lib/dumpstack.c:106 printaddressdescription linux/mm/kasan/report.c:377 printreport+0xc4/0x620 linux/mm/kasan/report.c:488 kasanreport+0xda/0x110 linux/mm/kasan/report.c:601 kfreeskblistreason+0x47e/0x4c0 linux/net/core/skbuff.c:1183 skbreleasedata+0x5af/0x880 linux/net/core/skbuff.c:1026 skbreleaseall linux/net/core/skbuff.c:1094 _kfreeskb linux/net/core/skbuff.c:1108 kfreeskbreason+0x12d/0x210 linux/net/core/skbuff.c:1144 kfreeskb linux/./include/linux/skbuff.h:1244 tipcbufappend+0x425/0xb50 linux/net/tipc/msg.c:186 tipclinkinput+0x224/0x7c0 linux/net/tipc/link.c:1324 tipclinkrcv+0x76e/0x2d70 linux/net/tipc/link.c:1824 tipcrcv+0x45f/0x10f0 linux/net/tipc/node.c:2159 tipcudprecv+0x73b/0x8f0 linux/net/tipc/udpmedia.c:390 udpqueuercvoneskb+0xad2/0x1850 linux/net/ipv4/udp.c:2108 udpqueuercvskb+0x131/0xb00 linux/net/ipv4/udp.c:2186 udpunicastrcvskb+0x165/0x3b0 linux/net/ipv4/udp.c:2346 _udp4librcv+0x2594/0x3400 linux/net/ipv4/udp.c:2422 ipprotocoldeliverrcu+0x30c/0x4e0 linux/net/ipv4/ipinput.c:205 iplocaldeliverfinish+0x2e4/0x520 linux/net/ipv4/ipinput.c:233 NFHOOK linux/./include/linux/netfilter.h:314 NFHOOK linux/./include/linux/netfilter.h:308 iplocaldeliver+0x18e/0x1f0 linux/net/ipv4/ipinput.c:254 dstinput linux/./include/net/dst.h:461 iprcvfinish linux/net/ipv4/ipinput.c:449 NFHOOK linux/./include/linux/netfilter.h:314 NFHOOK linux/./include/linux/netfilter.h:308 iprcv+0x2c5/0x5d0 linux/net/ipv4/ipinput.c:569 _netifreceiveskbonecore+0x199/0x1e0 linux/net/core/dev.c:5534 _netifreceiveskb+0x1f/0x1c0 linux/net/core/dev.c:5648 processbacklog+0x101/0x6b0 linux/net/core/dev.c:5976 _napipoll.constprop.0+0xba/0x550 linux/net/core/dev.c:6576 napipoll linux/net/core/dev.c:6645 netrxaction+0x95a/0xe90 linux/net/core/dev.c:6781 _dosoftirq+0x21f/0x8e7 linux/kernel/softirq.c:553 dosoftirq linux/kernel/softirq.c:454 dosoftirq+0xb2/0xf0 linux/kernel/softirq.c:441 </IRQ> <TASK> _localbhenableip+0x100/0x120 linux/kernel/softirq.c:381 localbhenable linux/./include/linux/bottomhalf.h:33 rcureadunlockbh linux/./include/linux/rcupdate.h:851 _devqueuexmit+0x871/0x3ee0 linux/net/core/dev.c:4378 devqueuexmit linux/./include/linux/netdevice.h:3169 neighhhoutput linux/./include/net/neighbour.h:526 neighoutput linux/./include/net/neighbour.h:540 ipfinishoutput2+0x169f/0x2550 linux/net/ipv4/ipoutput.c:235 _ipfinishoutput linux/net/ipv4/ipoutput.c:313 _ipfinishoutput+0x49e/0x950 linux/net/ipv4/ipoutput.c:295 ipfinishoutput+0x31/0x310 linux/net/ipv4/ipoutput.c:323 NFHOOKCOND linux/./include/linux/netfilter.h:303 ipoutput+0x13b/0x2a0 linux/net/ipv4/ipoutput.c:433 dstoutput linux/./include/net/dst.h:451 iplocalout linux/net/ipv4/ipoutput.c:129 ipsendskb+0x3e5/0x560 linux/net/ipv4/ipoutput.c:1492 udpsendskb+0x73f/0x1530 linux/net/ipv4/udp.c:963 udpsendmsg+0x1a36/0x2b40 linux/net/ipv4/udp.c:1250 inetsendmsg+0x105/0x140 linux/net/ipv4/afinet.c:850 socksendmsgnosec linux/net/socket.c:730 _socksendmsg linux/net/socket.c:745 _syssendto+0x42c/0x4e0 linux/net/socket.c:2191 _dosyssendto linux/net/socket.c:2203 _sesyssendto linux/net/socket.c:2199 _x64syssendto+0xe0/0x1c0 linux/net/socket.c:2199 dosyscallx64 linux/arch/x86/entry/common.c:52 dosyscall_ ---truncated---
[
    {
        "id": "CVE-2024-36886-026fed1f",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Line",
        "target": {
            "file": "net/tipc/msg.c"
        },
        "digest": {
            "line_hashes": [
                "287112646564060609917965879688806510482",
                "89655978760019107760869952219046476249",
                "118341315709039611123268593715201794224",
                "313557434169674741482720569659662443996",
                "240265189163525208627202253132027545690",
                "325796245101487862638281714552720367262",
                "84517224456848676151884505365399800594"
            ],
            "threshold": 0.9
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@367766ff9e407f8a68409b7ce4dc4d5a72afeab1"
    },
    {
        "id": "CVE-2024-36886-203db99c",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "target": {
            "file": "net/tipc/msg.c",
            "function": "tipc_buf_append"
        },
        "digest": {
            "function_hash": "236452931556121288271414037711394999525",
            "length": 1261.0
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@367766ff9e407f8a68409b7ce4dc4d5a72afeab1"
    },
    {
        "id": "CVE-2024-36886-21c53622",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Line",
        "target": {
            "file": "net/tipc/msg.c"
        },
        "digest": {
            "line_hashes": [
                "287112646564060609917965879688806510482",
                "89655978760019107760869952219046476249",
                "118341315709039611123268593715201794224",
                "313557434169674741482720569659662443996",
                "240265189163525208627202253132027545690",
                "325796245101487862638281714552720367262",
                "84517224456848676151884505365399800594"
            ],
            "threshold": 0.9
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ffd4917c1edb3c3ff334fce3704fbe9c39f35682"
    },
    {
        "id": "CVE-2024-36886-2aa17d92",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Line",
        "target": {
            "file": "net/tipc/msg.c"
        },
        "digest": {
            "line_hashes": [
                "287112646564060609917965879688806510482",
                "89655978760019107760869952219046476249",
                "118341315709039611123268593715201794224",
                "313557434169674741482720569659662443996",
                "240265189163525208627202253132027545690",
                "325796245101487862638281714552720367262",
                "84517224456848676151884505365399800594"
            ],
            "threshold": 0.9
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a0fbb26f8247e326a320e2cb4395bfb234332c90"
    },
    {
        "id": "CVE-2024-36886-321d7278",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "target": {
            "file": "net/tipc/msg.c",
            "function": "tipc_buf_append"
        },
        "digest": {
            "function_hash": "121904844205623287163321917609550527138",
            "length": 1265.0
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e19ec8ab0e25bc4803d7cc91c84e84532e2781bd"
    },
    {
        "id": "CVE-2024-36886-46757132",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "target": {
            "file": "net/tipc/msg.c",
            "function": "tipc_buf_append"
        },
        "digest": {
            "function_hash": "236452931556121288271414037711394999525",
            "length": 1261.0
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a0fbb26f8247e326a320e2cb4395bfb234332c90"
    },
    {
        "id": "CVE-2024-36886-492c2ffb",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Line",
        "target": {
            "file": "net/tipc/msg.c"
        },
        "digest": {
            "line_hashes": [
                "287112646564060609917965879688806510482",
                "89655978760019107760869952219046476249",
                "118341315709039611123268593715201794224",
                "313557434169674741482720569659662443996",
                "240265189163525208627202253132027545690",
                "325796245101487862638281714552720367262",
                "84517224456848676151884505365399800594"
            ],
            "threshold": 0.9
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@66116556076f0b96bc1aa9844008c743c8c67684"
    },
    {
        "id": "CVE-2024-36886-4c3ef67a",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "target": {
            "file": "net/tipc/msg.c",
            "function": "tipc_buf_append"
        },
        "digest": {
            "function_hash": "236452931556121288271414037711394999525",
            "length": 1261.0
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@21ea04aad8a0839b4ec27ef1691ca480620e8e14"
    },
    {
        "id": "CVE-2024-36886-50239283",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Line",
        "target": {
            "file": "net/tipc/msg.c"
        },
        "digest": {
            "line_hashes": [
                "287112646564060609917965879688806510482",
                "89655978760019107760869952219046476249",
                "118341315709039611123268593715201794224",
                "313557434169674741482720569659662443996",
                "240265189163525208627202253132027545690",
                "325796245101487862638281714552720367262",
                "84517224456848676151884505365399800594"
            ],
            "threshold": 0.9
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@93bc2d6d16f2c3178736ba6b845b30475856dc40"
    },
    {
        "id": "CVE-2024-36886-552047bc",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "target": {
            "file": "net/tipc/msg.c",
            "function": "tipc_buf_append"
        },
        "digest": {
            "function_hash": "322333895397107660749756587473796504197",
            "length": 1261.0
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@080cbb890286cd794f1ee788bbc5463e2deb7c2b"
    },
    {
        "id": "CVE-2024-36886-55b387d5",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "target": {
            "file": "net/tipc/msg.c",
            "function": "tipc_buf_append"
        },
        "digest": {
            "function_hash": "121904844205623287163321917609550527138",
            "length": 1265.0
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@93bc2d6d16f2c3178736ba6b845b30475856dc40"
    },
    {
        "id": "CVE-2024-36886-5ce3fb93",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Line",
        "target": {
            "file": "net/tipc/msg.c"
        },
        "digest": {
            "line_hashes": [
                "287112646564060609917965879688806510482",
                "89655978760019107760869952219046476249",
                "118341315709039611123268593715201794224",
                "313557434169674741482720569659662443996",
                "240265189163525208627202253132027545690",
                "325796245101487862638281714552720367262",
                "84517224456848676151884505365399800594"
            ],
            "threshold": 0.9
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@21ea04aad8a0839b4ec27ef1691ca480620e8e14"
    },
    {
        "id": "CVE-2024-36886-60ea38e1",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Line",
        "target": {
            "file": "net/tipc/msg.c"
        },
        "digest": {
            "line_hashes": [
                "287112646564060609917965879688806510482",
                "89655978760019107760869952219046476249",
                "118341315709039611123268593715201794224",
                "313557434169674741482720569659662443996",
                "240265189163525208627202253132027545690",
                "325796245101487862638281714552720367262",
                "84517224456848676151884505365399800594"
            ],
            "threshold": 0.9
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@080cbb890286cd794f1ee788bbc5463e2deb7c2b"
    },
    {
        "id": "CVE-2024-36886-7e179391",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "target": {
            "file": "net/tipc/msg.c",
            "function": "tipc_buf_append"
        },
        "digest": {
            "function_hash": "236452931556121288271414037711394999525",
            "length": 1261.0
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ffd4917c1edb3c3ff334fce3704fbe9c39f35682"
    },
    {
        "id": "CVE-2024-36886-8231f0dc",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "target": {
            "file": "net/tipc/msg.c",
            "function": "tipc_buf_append"
        },
        "digest": {
            "function_hash": "236452931556121288271414037711394999525",
            "length": 1261.0
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@66116556076f0b96bc1aa9844008c743c8c67684"
    },
    {
        "id": "CVE-2024-36886-8e563479",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Line",
        "target": {
            "file": "net/tipc/msg.c"
        },
        "digest": {
            "line_hashes": [
                "287112646564060609917965879688806510482",
                "89655978760019107760869952219046476249",
                "118341315709039611123268593715201794224",
                "313557434169674741482720569659662443996",
                "240265189163525208627202253132027545690",
                "325796245101487862638281714552720367262",
                "84517224456848676151884505365399800594"
            ],
            "threshold": 0.9
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e19ec8ab0e25bc4803d7cc91c84e84532e2781bd"
    }
]