CVE-2024-56688

In the Linux kernel, the following vulnerability has been resolved:

sunrpc: clear XPRT_SOCK_UPD_TIMEOUT when reset transport

Since transport->sock has been set to NULL during reset transport, XPRT_SOCK_UPD_TIMEOUT also needs to be cleared. Otherwise, the xs_tcp_set_socket_timeouts() may be triggered in xs_tcp_send_request() to dereference the transport->sock that has been set to NULL.

This vulnerability is rated as Moderate because exploitation is restricted to causing a kernel crash (denial of service) without compromising system confidentiality or integrity. The issue occurs within the kernel's SunRPC transport layer during connection resets, primarily affecting systems actively using RPC-based network services such as NFS. While a local user capable of triggering or timing network RPC disconnects could induce the condition, the flaw cannot be leveraged for privilege escalation or unauthorized data modification.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.