CVE-2024-36009

CVE-2024-36009 addresses a reference count issue in the Linux kernel's AX.25 networking protocol, specifically within the ax25_cb and ax25_dev structures. This bug leads to a "reference already released" error, indicating improper deallocation of a dev_tracker when an AX.25 device detaches. The vulnerability affects Linux kernel versions and has been resolved by correcting the dev_tracker deallocation logic. Rated as Medium severity (CVSS 5.5), this vulnerability has a local attack vector and low attack complexity, requiring local user privileges. The potential impact is high availability loss (A:H), as it can cause system instability or crashes due to improper memory management, but does not directly impact confidentiality or integrity. Currently, there is no evidence of active exploitation, nor are there any known public exploit codes in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage for this CVE are minimal, suggesting it has not garnered significant attention from the cybersecurity community.