In net/socket.c in the Linux kernel through 4.17.1, there is a race condition between fchownat and close in cases where they target the same socket file descriptor, related to the sock_close and sockfs_setattr functions. fchownat does not increment the file descriptor reference count, which allows close to set the socket to NULL during fchownat's execution, leading to a NULL pointer dereference and system crash.
4.13.0-16.194.13.0-17.204.13.0-25.294.13.0-32.354.15.0-10.114.15.0-12.134.15.0-13.144.15.0-15.164.15.0-19.204.15.0-20.21+6 more4.15.0-33.364.15.0-1001.14.15.0-1003.34.15.0-1005.54.15.0-1006.64.15.0-1007.74.15.0-1009.94.15.0-1010.104.15.0-1011.114.15.0-1016.164.15.0-1017.17+1 more4.15.0-1020.204.15.0-1023.24~14.04.14.11.0-1009.94.11.0-1011.114.11.0-1013.134.11.0-1014.144.11.0-1015.154.11.0-1016.164.13.0-1005.74.13.0-1006.84.13.0-1007.94.13.0-1009.12+10 more4.15.0-1022.22~16.04.14.15.0-1002.24.15.0-1003.34.15.0-1004.44.15.0-1008.84.15.0-1009.94.15.0-1012.124.15.0-1013.134.15.0-1014.144.15.0-1018.184.15.0-1019.19+1 more4.15.0-1022.234.10.0-1004.44.10.0-1006.64.10.0-1007.74.10.0-1008.84.10.0-1009.94.13.0-1002.54.13.0-1006.94.13.0-1007.104.13.0-1008.114.13.0-1011.15+8 more4.15.0-1018.19~16.04.24.15.0-1001.14.15.0-1003.34.15.0-1005.54.15.0-1006.64.15.0-1008.84.15.0-1009.94.15.0-1010.104.15.0-1014.144.15.0-1015.154.15.0-1017.184.15.0-1018.194.10.0-27.30~16.04.24.10.0-28.32~16.04.24.10.0-30.34~16.04.14.10.0-32.36~16.04.14.10.0-33.37~16.04.14.10.0-35.39~16.04.14.10.0-37.41~16.04.14.10.0-38.42~16.04.14.10.0-40.44~16.04.14.10.0-42.46~16.04.1+28 more4.15.0-33.36~16.04.14.15.0-1002.24.15.0-1003.34.15.0-1004.44.15.0-1006.64.15.0-1008.84.15.0-1010.104.15.0-1011.114.15.0-1012.124.15.0-1016.164.15.0-1017.17+1 more4.15.0-1020.204.15.0-1002.34.15.0-1004.54.15.0-1006.94.15.0-1008.114.15.0-1009.124.15.0-1012.154.15.0-1013.164.15.0-1015.184.15.0-1017.20Exploitability
AV:NAC:HPR:NUI:NScope
S:UImpact
C:NI:NA:HCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H