CVE-2024-36009

A vulnerability was found in the Linux kernel's AX.25 protocol implementation. The issue arises from incorrect handling of the netdev reference count, where the dev_tracker associated with the AX.25 device is improperly managed. Specifically, the dev_tracker of the ax25_cb should be deallocated during device detachment in the ax25_kill_by_device() function, but it was mistakenly tied to the ax25_dev. This mismanagement leads to a reference count mismatch, triggering warnings and potential system instability, as indicated by logs showing already released references.

Red Hat Enterprise Linux is not vulnerable to this CVE, as it does not affect the versions or configurations of the Linux kernel used in its distributions.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.