DEBIAN-CVE-2024-36971

In the Linux kernel, the following vulnerability has been resolved:  net: fix dstnegativeadvice() race  dstnegativeadvice() does not enforce proper RCU rules when sk->dstcache must be cleared, leading to possible UAF.  RCU rules are that we must first clear sk->skdstcache, then call dstrelease(olddst).  Note that skdstreset(sk) is implementing this protocol correctly, while dstnegativeadvice() uses the wrong order.  Given that ip6negativeadvice() has special logic against RTFCACHE, this means each of the three ->negativeadvice() existing methods must perform the skdstreset() themselves.  Note the check against NULL dst is centralized in dstnegative_advice(), there is no need to duplicate it in various callbacks.  Many thanks to Clement Lecigne for tracking this issue.  This old bug became visible after the blamed commit, using UDP sockets.