CVE-2024-56640
A critical use‑after‑free bug in the Linux kernel’s SMC (Secure Management Channel) subsystem can cause a crash or allow arbitrary code execution. The flaw occurs when reference counts for LGR/link objects are released too many times, leading to unsafe memory access. The issue has been fixed in recent kernel releases.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Linux kernel versions prior to 6.13, including the 6.13 release, are vulnerable. Systems running these kernels without the patch are at risk.
Real-world impact
An attacker could trigger the bug to crash the kernel or potentially run malicious code with kernel privileges, leading to complete system compromise.
Why this severity
The CVSS score of 9.8 reflects that the vulnerability requires no authentication, no user interaction, and gives an attacker full control over confidentiality, integrity, and availability.
What to do about it
- 01Update the Linux kernel to version 6.13 or later.
- 02Reboot the system to load the new kernel.
NVD-referenced vendor advisory
Timeline
- Dec 27, 2024 · Dec 27, 2024PublishedDisclosed and added to the National Vulnerability Database.
- Aug 4, 2026 · 2d agoAdvisory updatedThe NVD record was last revised.
- Aug 4, 2026 · 1d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.