diff --git a/volatility3/framework/plugins/linux/sockstat.py b/volatility3/framework/plugins/linux/sockstat.py index a73d5581a..f526d614e 100644 --- a/volatility3/framework/plugins/linux/sockstat.py +++ b/volatility3/framework/plugins/linux/sockstat.py @@ -416,8 +416,7 @@ class Sockstat(plugins.PluginInterface): socket_alloc = linux.LinuxUtilities.container_of(d_inode, "socket_alloc", "vfs_inode", vmlinux) socket = socket_alloc.socket - vfs_inode = socket_alloc.vfs_inode - if not (socket and vfs_inode): + if not (socket and socket.sk): continue sock = socket.sk.dereference()