Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%

Buy Us a Coffee

CVE-2024-56566— mm/slub: Avoid list corruption when removing a slab from the full list

Quick assessment

Affected

Linux Linux

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于ALSA:usx2y模块中USB断开时资源释放不当，可能导致内存泄漏。

AI Predicted 5.5 Difficulty: Moderate EPSS 0.22% · P12 Updated May 13, 2026

Possible ATT&CK Techniques 2 AI

T1499.003 · Application Exhaustion Flood T1499 · Endpoint Denial of Service

Affected Version Matrix 8

Vendor	Product	Version Range	Status
Linux	Linux	`643b113849d8faa68c9f01c3c9d929bfbffd50bd< 33a213c04faff6c3a7fe77e947db81bc7270fe32`	affected
		`643b113849d8faa68c9f01c3c9d929bfbffd50bd< 943c0f601cd28c1073b92b5f944c6c6c2643e709`	affected
		`643b113849d8faa68c9f01c3c9d929bfbffd50bd< dbc16915279a548a204154368da23d402c141c81`	affected
		`2.6.22`	affected
		`< 2.6.22`	unaffected
		`6.6.64≤ 6.6.*`	unaffected
		`6.12.4≤ 6.12.*`	unaffected
		`6.13≤ *`	unaffected

Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2024-56566

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

mm/slub: Avoid list corruption when removing a slab from the full list

Source: CVE Program / CVE List V5

Vulnerability Description

In the Linux kernel, the following vulnerability has been resolved: mm/slub: Avoid list corruption when removing a slab from the full list Boot with slub_debug=UFPZ. If allocated object failed in alloc_consistency_checks, all objects of the slab will be marked as used, and then the slab will be removed from the partial list. When an object belonging to the slab got freed later, the remove_full() function is called. Because the slab is neither on the partial list nor on the full list, it eventually lead to a list corruption (actually a list poison being detected). So we need to mark and isolate the slab page with metadata corruption, do not put it back in circulation. Because the debug caches avoid all the fastpaths, reusing the frozen bit to mark slab page with metadata corruption seems to be fine. [ 4277.385669] list_del corruption, ffffea00044b3e50->next is LIST_POISON1 (dead000000000100) [ 4277.387023] ------------[ cut here ]------------ [ 4277.387880] kernel BUG at lib/list_debug.c:56! [ 4277.388680] invalid opcode: 0000 [#1] PREEMPT SMP PTI [ 4277.389562] CPU: 5 PID: 90 Comm: kworker/5:1 Kdump: loaded Tainted: G OE 6.6.1-1 #1 [ 4277.392113] Workqueue: xfs-inodegc/vda1 xfs_inodegc_worker [xfs] [ 4277.393551] RIP: 0010:__list_del_entry_valid_or_report+0x7b/0xc0 [ 4277.394518] Code: 48 91 82 e8 37 f9 9a ff 0f 0b 48 89 fe 48 c7 c7 28 49 91 82 e8 26 f9 9a ff 0f 0b 48 89 fe 48 c7 c7 58 49 91 [ 4277.397292] RSP: 0018:ffffc90000333b38 EFLAGS: 00010082 [ 4277.398202] RAX: 000000000000004e RBX: ffffea00044b3e50 RCX: 0000000000000000 [ 4277.399340] RDX: 0000000000000002 RSI: ffffffff828f8715 RDI: 00000000ffffffff [ 4277.400545] RBP: ffffea00044b3e40 R08: 0000000000000000 R09: ffffc900003339f0 [ 4277.401710] R10: 0000000000000003 R11: ffffffff82d44088 R12: ffff888112cf9910 [ 4277.402887] R13: 0000000000000001 R14: 0000000000000001 R15: ffff8881000424c0 [ 4277.404049] FS: 0000000000000000(0000) GS:ffff88842fd40000(0000) knlGS:0000000000000000 [ 4277.405357] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 4277.406389] CR2: 00007f2ad0b24000 CR3: 0000000102a3a006 CR4: 00000000007706e0 [ 4277.407589] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 4277.408780] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 4277.410000] PKRU: 55555554 [ 4277.410645] Call Trace: [ 4277.411234] <TASK> [ 4277.411777] ? die+0x32/0x80 [ 4277.412439] ? do_trap+0xd6/0x100 [ 4277.413150] ? __list_del_entry_valid_or_report+0x7b/0xc0 [ 4277.414158] ? do_error_trap+0x6a/0x90 [ 4277.414948] ? __list_del_entry_valid_or_report+0x7b/0xc0 [ 4277.415915] ? exc_invalid_op+0x4c/0x60 [ 4277.416710] ? __list_del_entry_valid_or_report+0x7b/0xc0 [ 4277.417675] ? asm_exc_invalid_op+0x16/0x20 [ 4277.418482] ? __list_del_entry_valid_or_report+0x7b/0xc0 [ 4277.419466] ? __list_del_entry_valid_or_report+0x7b/0xc0 [ 4277.420410] free_to_partial_list+0x515/0x5e0 [ 4277.421242] ? xfs_iext_remove+0x41a/0xa10 [xfs] [ 4277.422298] xfs_iext_remove+0x41a/0xa10 [xfs] [ 4277.423316] ? xfs_inodegc_worker+0xb4/0x1a0 [xfs] [ 4277.424383] xfs_bmap_del_extent_delay+0x4fe/0x7d0 [xfs] [ 4277.425490] __xfs_bunmapi+0x50d/0x840 [xfs] [ 4277.426445] xfs_itruncate_extents_flags+0x13a/0x490 [xfs] [ 4277.427553] xfs_inactive_truncate+0xa3/0x120 [xfs] [ 4277.428567] xfs_inactive+0x22d/0x290 [xfs] [ 4277.429500] xfs_inodegc_worker+0xb4/0x1a0 [xfs] [ 4277.430479] process_one_work+0x171/0x340 [ 4277.431227] worker_thread+0x277/0x390 [ 4277.431962] ? __pfx_worker_thread+0x10/0x10 [ 4277.432752] kthread+0xf0/0x120 [ 4277.433382] ? __pfx_kthread+0x10/0x10 [ 4277.434134] ret_from_fork+0x2d/0x50 [ 4277.434837] ? __pfx_kthread+0x10/0x10 [ 4277.435566] ret_from_fork_asm+0x1b/0x30 [ 4277.436280] </TASK>

Source: CVE Program / CVE List V5

CVSS Information

N/A

Source: CVE Program / CVE List V5

Vulnerability Type

N/A

Source: CVE Program / CVE List V5

Vulnerability Title

Linux kernel 安全漏洞

Source: CNNVD (China National Vulnerability Database)

Vulnerability Description

Source: CNNVD (China National Vulnerability Database)

CVSS Information

N/A

Source: CNNVD (China National Vulnerability Database)

Vulnerability Type

N/A

Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Linux	Linux	643b113849d8faa68c9f01c3c9d929bfbffd50bd ~ 33a213c04faff6c3a7fe77e947db81bc7270fe32	-
Linux	Linux	2.6.22	-

II. Public POCs for CVE-2024-56566

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2024-56566

请登录查看更多情报信息。

Patches & Fixes for CVE-2024-56566 (3)

https://www.cve.org/CVERecord?id=CVE-2024-56566

Same Patch Batch · Linux · 2024-12-27 · 221 CVEs total

CVE-2024-53206	9.8 CRITICAL	tcp: Fix use-after-free of nreq in reqsk_timer_handler().
CVE-2024-53209	9.8 CRITICAL	bnxt_en: Fix receive ring space parameters when XDP is active
CVE-2024-56656	9.8 CRITICAL	bnxt_en: Fix aggregation ID mask to prevent oops on 5760X chips
CVE-2024-53169	9.8 CRITICAL	nvme-fabrics: fix kernel crash while shutting down controller
CVE-2024-56645	9.8 CRITICAL	can: j1939: j1939_session_new(): fix skb reference counting
CVE-2024-53186	9.8 CRITICAL	ksmbd: fix use-after-free in SMB request handling
CVE-2024-56640	9.8 CRITICAL	net/smc: fix LGR and link use-after-free issue
CVE-2024-53176	9.8 CRITICAL	smb: During unmount, ensure all cached dir instances drop their dentry
CVE-2024-53177	9.8 CRITICAL	smb: prevent use-after-free due to open_cached_dir error paths
CVE-2024-53179	9.8 CRITICAL	smb: client: fix use-after-free of signing key
CVE-2024-56626	8.8 HIGH	ksmbd: fix Out-of-Bounds Write in ksmbd_vfs_stream_write
CVE-2024-56653	8.8 HIGH	Bluetooth: btmtk: avoid UAF in btmtk_process_coredump
CVE-2024-56651	8.8 HIGH	can: hi311x: hi3110_can_ist(): fix potential use-after-free
CVE-2024-56591	8.8 HIGH	Bluetooth: hci_conn: Use disable_delayed_work_sync
CVE-2024-53224	8.8 HIGH	RDMA/mlx5: Move events notifier registration to be after device registration
CVE-2024-53237	8.8 HIGH	Bluetooth: fix use-after-free in device_for_each_child()
CVE-2024-56669	8.8 HIGH	iommu/vt-d: Remove cache tags before disabling ATS
CVE-2024-56627	8.1 HIGH	ksmbd: fix Out-of-Bounds Read in ksmbd_vfs_stream_read
CVE-2024-53214	7.8 HIGH	vfio/pci: Properly hide first-in-list PCIe extended capability
CVE-2024-56619	7.8 HIGH	nilfs2: fix potential out-of-bounds memory access in nilfs_find_entry()

Showing top 20 of 221 CVEs. View all on vendor page → →

IV. Related Vulnerabilities

Same product: Linux

Same vendor: Linux

V. Comments for CVE-2024-56566

No comments yet

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2024-56566— mm/slub: Avoid list corruption when removing a slab from the full list

Quick assessment

Possible ATT&CK Techniques 2 AI

Affected Version Matrix 8

I. Basic Information for CVE-2024-56566

Vulnerability Information

Vulnerability Title

Vulnerability Description

CVSS Information

Vulnerability Type

Vulnerability Title

Vulnerability Description

CVSS Information

Vulnerability Type

Affected Products

II. Public POCs for CVE-2024-56566

III. Intelligence Information for CVE-2024-56566

Patches & Fixes for CVE-2024-56566 (3)

Same Patch Batch · Linux · 2024-12-27 · 221 CVEs total

IV. Related Vulnerabilities

V. Comments for CVE-2024-56566

Leave a comment