| --- a/CVE-2024-56642.mbox | |
| +++ b/CVE-2024-56642.mbox | |
| @@ -9,7 +9,7 @@ When bearer_disable() calls tipc_udp_disable(), cleanup | |
| of the UDP kernel socket is deferred by work calling | |
| cleanup_bearer(). | |
| -tipc_net_stop() waits for such works to finish by checking | |
| +tipc_exit_net() waits for such works to finish by checking | |
| tipc_net(net)->wq_count. However, the work decrements the | |
| count too early before releasing the kernel socket, | |
| unblocking cleanup_net() and resulting in use-after-free. |