CVE-2024-56645

In the Linux kernel, the following vulnerability has been resolved:

can: j1939: j1939_session_new(): fix skb reference counting

Since j1939_session_skb_queue() does an extra skb_get() for each new skb, do the same for the initial one in j1939_session_new() to avoid refcount underflow.

[mkl: clean up commit message]

Red Hat rates this vulnerability as Moderate because exploitation requires local access to create CAN J1939 sockets, and CAN networking hardware or configurations are rarely utilized in standard enterprise deployments. While a local attacker could trigger the socket buffer reference counting underflow to cause a system crash, the blast radius is confined to the local host. Enterprise Linux default configurations do not actively enable CAN networking interfaces.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.