GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2024-35998 (GCVE-0-2024-35998)

Vulnerability from cvelistv5 – Published: 2024-05-20 09:48 – Updated: 2026-08-05 11:31
VLAI
Title
smb3: fix lock ordering potential deadlock in cifs_sync_mid_result
Summary
In the Linux kernel, the following vulnerability has been resolved: smb3: fix lock ordering potential deadlock in cifs_sync_mid_result Coverity spotted that the cifs_sync_mid_result function could deadlock "Thread deadlock (ORDER_REVERSAL) lock_order: Calling spin_lock acquires lock TCP_Server_Info.srv_lock while holding lock TCP_Server_Info.mid_lock" Addresses-Coverity: 1590401 ("Thread deadlock (ORDER_REVERSAL)")
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-05-20 15:02 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 64d62ac6d6514cba1305bd08e271ec1843bdd612 , < c7a4bca289e50bb4b2650f845c41bb3e453f4c66 (git)
Affected: 90c49fce1c43e1cc152695e20363ff5087897c09 , < 699f8958dece132709c0bff6a9700999a2a63b75 (git)
Affected: 90c49fce1c43e1cc152695e20363ff5087897c09 , < 8248224ab5b8ca7559b671917c224296a4d671fc (git)
Affected: 90c49fce1c43e1cc152695e20363ff5087897c09 , < 8861fd5180476f45f9e8853db154600469a0284f (git)
Affected: c511954bf142fe1995aec3c739a9f1a76990283a (git)
Affected: 0b08c4c499200be67d54c439d56e5ea866869945 (git)
Affected: 6.1.28 , < 6.1.90 (semver)
Affected: 6.2.15 , < 6.3 (semver)
Affected: 6.3.2 , < 6.4 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 6.4
Unaffected: 0 , < 6.4 (semver)
Unaffected: 6.1.90 , ≤ 6.1.* (semver)
Unaffected: 6.6.30 , ≤ 6.6.* (semver)
Unaffected: 6.8.9 , ≤ 6.8.* (semver)
Unaffected: 6.9 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-35998",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-20T15:02:37.597444Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:33:59.159Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T03:30:11.585Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/c7a4bca289e50bb4b2650f845c41bb3e453f4c66"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/699f8958dece132709c0bff6a9700999a2a63b75"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/8248224ab5b8ca7559b671917c224296a4d671fc"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/8861fd5180476f45f9e8853db154600469a0284f"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/transport.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "c7a4bca289e50bb4b2650f845c41bb3e453f4c66",
              "status": "affected",
              "version": "64d62ac6d6514cba1305bd08e271ec1843bdd612",
              "versionType": "git"
            },
            {
              "lessThan": "699f8958dece132709c0bff6a9700999a2a63b75",
              "status": "affected",
              "version": "90c49fce1c43e1cc152695e20363ff5087897c09",
              "versionType": "git"
            },
            {
              "lessThan": "8248224ab5b8ca7559b671917c224296a4d671fc",
              "status": "affected",
              "version": "90c49fce1c43e1cc152695e20363ff5087897c09",
              "versionType": "git"
            },
            {
              "lessThan": "8861fd5180476f45f9e8853db154600469a0284f",
              "status": "affected",
              "version": "90c49fce1c43e1cc152695e20363ff5087897c09",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "c511954bf142fe1995aec3c739a9f1a76990283a",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "0b08c4c499200be67d54c439d56e5ea866869945",
              "versionType": "git"
            },
            {
              "lessThan": "6.1.90",
              "status": "affected",
              "version": "6.1.28",
              "versionType": "semver"
            },
            {
              "lessThan": "6.3",
              "status": "affected",
              "version": "6.2.15",
              "versionType": "semver"
            },
            {
              "lessThan": "6.4",
              "status": "affected",
              "version": "6.3.2",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/transport.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.4"
            },
            {
              "lessThan": "6.4",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.90",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.30",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.8.*",
              "status": "unaffected",
              "version": "6.8.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.9",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.90",
                  "versionStartIncluding": "6.1.28",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.30",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8.9",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.2.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.3.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb3: fix lock ordering potential deadlock in cifs_sync_mid_result\n\nCoverity spotted that the cifs_sync_mid_result function could deadlock\n\n\"Thread deadlock (ORDER_REVERSAL) lock_order: Calling spin_lock acquires\nlock TCP_Server_Info.srv_lock while holding lock TCP_Server_Info.mid_lock\"\n\nAddresses-Coverity: 1590401 (\"Thread deadlock (ORDER_REVERSAL)\")"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - Both halves of the lock-order reversal are driven by SMB3 response frames received from the remote server \u2014 `smb2_decrypt_offload()` runs on server-supplied encrypted read payloads, and the mid states examined in `cifs_sync_mid_result()` are set solely by response parsing (`dequeue_mid()`, `handle_read_data()`). A malicious, compromised, or MITM\u0027d SMB server reaches the code purely over the network, matching this CNA\u0027s AV:N treatment of other cifs-client bugs (CVE-2024-39468, CVE-2024-42256).\nAC:L - The remote server controls both sides of the race \u2014 it chooses response size, encryption, timing, and error status, so it can drive `smb2_decrypt_offload()` into its `srv_lock`\u2192`mid_lock` branch on one CPU while forcing an unexpected mid state into `cifs_sync_mid_result()`\u0027s `mid_lock`\u2192`srv_lock` path on another, and it can repeat this indefinitely. Where the attacker creates the race, AC is Low.\nPR:N - The attacker is the remote SMB peer (or a network attacker able to spoof/hijack the SMB connection); no account, credential, or local privilege on the victim host is required to send the responses that trigger the deadlock.\nUI:N - Exploitation needs no victim action \u2014 the CIFS share is already mounted as a normal deployment condition (fstab/automount), and ordinary background I/O supplies the requests whose responses the attacker manipulates.\nS:U - The deadlock is confined to the kernel of the affected client machine; no VM, IOMMU, or sandbox boundary is crossed.\nC:N - The bug is purely a lock acquisition-order violation \u2014 no memory is read out of bounds, no freed object is accessed, and no data is disclosed.\nI:N - No memory corruption, out-of-bounds write, or data modification occurs; the flaw only affects the order in which two spinlocks are taken.\nA:H - An ABBA deadlock on `srv_lock`/`mid_lock` permanently wedges two CPUs spinning with preemption disabled while holding both locks, hanging all CIFS I/O and every subsequent taker of either lock, resulting in a hard lockup/panic."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:31:29.368Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/c7a4bca289e50bb4b2650f845c41bb3e453f4c66"
        },
        {
          "url": "https://git.kernel.org/stable/c/699f8958dece132709c0bff6a9700999a2a63b75"
        },
        {
          "url": "https://git.kernel.org/stable/c/8248224ab5b8ca7559b671917c224296a4d671fc"
        },
        {
          "url": "https://git.kernel.org/stable/c/8861fd5180476f45f9e8853db154600469a0284f"
        }
      ],
      "title": "smb3: fix lock ordering potential deadlock in cifs_sync_mid_result",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-35998",
    "datePublished": "2024-05-20T09:48:01.009Z",
    "dateReserved": "2024-05-17T13:50:33.148Z",
    "dateUpdated": "2026-08-05T11:31:29.368Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-35998",
      "date": "2026-09-18",
      "epss": "0.00393",
      "percentile": "0.33281"
    },
    "fkie_nvd": {
      "configurations": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "5EFC6541-FBE4-4C8D-A751-5658F0AD41C1",
                  "versionEndExcluding": "6.1.90",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "84046DAF-73CF-429D-9BA4-05B658B377B5",
                  "versionEndExcluding": "6.6.30",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "5F9041E5-8358-4EF7-8F98-B812EDE49612",
                  "versionEndExcluding": "6.8.9",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:6.9:rc1:*:*:*:*:*:*",
                  "matchCriteriaId": "22BEDD49-2C6D-402D-9DBF-6646F6ECD10B",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:6.9:rc2:*:*:*:*:*:*",
                  "matchCriteriaId": "DF73CB2A-DFFD-46FB-9BFE-AA394F27EA37",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:6.9:rc3:*:*:*:*:*:*",
                  "matchCriteriaId": "52048DDA-FC5A-4363-95A0-A6357B4D7F8C",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:6.9:rc4:*:*:*:*:*:*",
                  "matchCriteriaId": "A06B2CCF-3F43-4FA9-8773-C83C3F5764B2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:6.9:rc5:*:*:*:*:*:*",
                  "matchCriteriaId": "F850DCEC-E08B-4317-A33B-D2DCF39F601B",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb3: fix lock ordering potential deadlock in cifs_sync_mid_result\n\nCoverity spotted that the cifs_sync_mid_result function could deadlock\n\n\"Thread deadlock (ORDER_REVERSAL) lock_order: Calling spin_lock acquires\nlock TCP_Server_Info.srv_lock while holding lock TCP_Server_Info.mid_lock\"\n\nAddresses-Coverity: 1590401 (\"Thread deadlock (ORDER_REVERSAL)\")"
        },
        {
          "lang": "es",
          "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: smb3: corrige el posible interbloqueo en el orden de bloqueo en cifs_sync_mid_result Coverity detect\u00f3 que la funci\u00f3n cifs_sync_mid_result podr\u00eda interbloquearse \"Interbloqueo de subprocesos (ORDER_REVERSAL) lock_order: llamar a spin_lock adquiere el bloqueo TCP_Server_Info.srv_lock mientras mantiene el bloqueo TCP_Server_Info.mid_lock \"Direcciones-Cobertura: 1590401 (\"Estancamiento del hilo (ORDER_REVERSAL)\")"
        }
      ],
      "id": "CVE-2024-35998",
      "lastModified": "2025-01-10T18:12:11.843",
      "metrics": {
        "cvssMetricV31": [
          {
            "cvssData": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 5.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            },
            "exploitabilityScore": 1.8,
            "impactScore": 3.6,
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      },
      "published": "2024-05-20T10:15:14.030",
      "references": [
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/699f8958dece132709c0bff6a9700999a2a63b75"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/8248224ab5b8ca7559b671917c224296a4d671fc"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/8861fd5180476f45f9e8853db154600469a0284f"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/c7a4bca289e50bb4b2650f845c41bb3e453f4c66"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/699f8958dece132709c0bff6a9700999a2a63b75"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/8248224ab5b8ca7559b671917c224296a4d671fc"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/8861fd5180476f45f9e8853db154600469a0284f"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/c7a4bca289e50bb4b2650f845c41bb3e453f4c66"
        }
      ],
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Analyzed",
      "weaknesses": [
        {
          "description": [
            {
              "lang": "en",
              "value": "CWE-667"
            }
          ],
          "source": "nvd@nist.gov",
          "type": "Primary"
        }
      ]
    },
    "microsoft_vex": {
      "current_release_date": "2026-03-31T15:13:42.000Z",
      "cve": "CVE-2024-35998",
      "id": "msrc_CVE-2024-35998",
      "initial_release_date": "2024-05-02T07:00:00.000Z",
      "product_status:under_investigation": "3",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "smb3: fix lock ordering potential deadlock in cifs_sync_mid_result",
      "url": "https://msrc.microsoft.com/csaf/vex/2024/msrc_cve-2024-35998.json",
      "version": "3"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "fs/smb/client/transport.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "c7a4bca289e50bb4b2650f845c41bb3e453f4c66",
                    "status": "affected",
                    "version": "64d62ac6d6514cba1305bd08e271ec1843bdd612",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "699f8958dece132709c0bff6a9700999a2a63b75",
                    "status": "affected",
                    "version": "90c49fce1c43e1cc152695e20363ff5087897c09",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "8248224ab5b8ca7559b671917c224296a4d671fc",
                    "status": "affected",
                    "version": "90c49fce1c43e1cc152695e20363ff5087897c09",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "8861fd5180476f45f9e8853db154600469a0284f",
                    "status": "affected",
                    "version": "90c49fce1c43e1cc152695e20363ff5087897c09",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "c511954bf142fe1995aec3c739a9f1a76990283a",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "0b08c4c499200be67d54c439d56e5ea866869945",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "6.1.90",
                    "status": "affected",
                    "version": "6.1.28",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "6.3",
                    "status": "affected",
                    "version": "6.2.15",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "6.4",
                    "status": "affected",
                    "version": "6.3.2",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "fs/smb/client/transport.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.4"
                  },
                  {
                    "lessThan": "6.4",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.90",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.30",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.8.*",
                    "status": "unaffected",
                    "version": "6.8.9",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.9",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "5EFC6541-FBE4-4C8D-A751-5658F0AD41C1",
                    "versionEndExcluding": "6.1.90",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "84046DAF-73CF-429D-9BA4-05B658B377B5",
                    "versionEndExcluding": "6.6.30",
                    "versionStartIncluding": "6.2",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "5F9041E5-8358-4EF7-8F98-B812EDE49612",
                    "versionEndExcluding": "6.8.9",
                    "versionStartIncluding": "6.7",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.9:rc1:*:*:*:*:*:*",
                    "matchCriteriaId": "22BEDD49-2C6D-402D-9DBF-6646F6ECD10B",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.9:rc2:*:*:*:*:*:*",
                    "matchCriteriaId": "DF73CB2A-DFFD-46FB-9BFE-AA394F27EA37",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.9:rc3:*:*:*:*:*:*",
                    "matchCriteriaId": "52048DDA-FC5A-4363-95A0-A6357B4D7F8C",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.9:rc4:*:*:*:*:*:*",
                    "matchCriteriaId": "A06B2CCF-3F43-4FA9-8773-C83C3F5764B2",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.9:rc5:*:*:*:*:*:*",
                    "matchCriteriaId": "F850DCEC-E08B-4317-A33B-D2DCF39F601B",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb3: fix lock ordering potential deadlock in cifs_sync_mid_result\n\nCoverity spotted that the cifs_sync_mid_result function could deadlock\n\n\"Thread deadlock (ORDER_REVERSAL) lock_order: Calling spin_lock acquires\nlock TCP_Server_Info.srv_lock while holding lock TCP_Server_Info.mid_lock\"\n\nAddresses-Coverity: 1590401 (\"Thread deadlock (ORDER_REVERSAL)\")"
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: smb3: corrige el posible interbloqueo en el orden de bloqueo en cifs_sync_mid_result Coverity detect\u00f3 que la funci\u00f3n cifs_sync_mid_result podr\u00eda interbloquearse \"Interbloqueo de subprocesos (ORDER_REVERSAL) lock_order: llamar a spin_lock adquiere el bloqueo TCP_Server_Info.srv_lock mientras mantiene el bloqueo TCP_Server_Info.mid_lock \"Direcciones-Cobertura: 1590401 (\"Estancamiento del hilo (ORDER_REVERSAL)\")"
          }
        ],
        "id": "CVE-2024-35998",
        "lastModified": "2026-08-04T11:18:20.397",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 3.6,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 5.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 3.6,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2024-35998",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-20T15:02:37.597444Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2024-05-20T10:15:14.030",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/699f8958dece132709c0bff6a9700999a2a63b75"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/8248224ab5b8ca7559b671917c224296a4d671fc"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/8861fd5180476f45f9e8853db154600469a0284f"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/c7a4bca289e50bb4b2650f845c41bb3e453f4c66"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/699f8958dece132709c0bff6a9700999a2a63b75"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/8248224ab5b8ca7559b671917c224296a4d671fc"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/8861fd5180476f45f9e8853db154600469a0284f"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/c7a4bca289e50bb4b2650f845c41bb3e453f4c66"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-667"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T18:57:02+00:00",
      "cve": "CVE-2024-35998",
      "id": "CVE-2024-35998",
      "initial_release_date": "2024-05-20T00:00:00+00:00",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: smb3: fix lock ordering potential deadlock in cifs_sync_mid_result",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-35998.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-31T13:55:23Z",
      "cve": "CVE-2024-35998",
      "id": "CVE-2024-35998",
      "initial_release_date": "2024-05-21T01:58:21Z",
      "product_status:known_affected": "351",
      "product_status:known_not_affected": "201",
      "product_status:recommended": "736",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-35998",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-35998.json",
      "version": "96"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "providerMetadata": {
              "dateUpdated": "2024-08-02T03:30:11.585Z",
              "orgId": "af854a3a-2127-422b-91ae-364da2661108",
              "shortName": "CVE"
            },
            "references": [
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/c7a4bca289e50bb4b2650f845c41bb3e453f4c66"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/699f8958dece132709c0bff6a9700999a2a63b75"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/8248224ab5b8ca7559b671917c224296a4d671fc"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/8861fd5180476f45f9e8853db154600469a0284f"
              }
            ],
            "title": "CVE Program Container"
          },
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2024-35998",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2024-05-20T15:02:37.597444Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2024-05-23T19:01:24.894Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Linux",
              "programFiles": [
                "fs/smb/client/transport.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "lessThan": "c7a4bca289e50bb4b2650f845c41bb3e453f4c66",
                  "status": "affected",
                  "version": "64d62ac6d6514cba1305bd08e271ec1843bdd612",
                  "versionType": "git"
                },
                {
                  "lessThan": "699f8958dece132709c0bff6a9700999a2a63b75",
                  "status": "affected",
                  "version": "90c49fce1c43e1cc152695e20363ff5087897c09",
                  "versionType": "git"
                },
                {
                  "lessThan": "8248224ab5b8ca7559b671917c224296a4d671fc",
                  "status": "affected",
                  "version": "90c49fce1c43e1cc152695e20363ff5087897c09",
                  "versionType": "git"
                },
                {
                  "lessThan": "8861fd5180476f45f9e8853db154600469a0284f",
                  "status": "affected",
                  "version": "90c49fce1c43e1cc152695e20363ff5087897c09",
                  "versionType": "git"
                },
                {
                  "status": "affected",
                  "version": "c511954bf142fe1995aec3c739a9f1a76990283a",
                  "versionType": "git"
                },
                {
                  "status": "affected",
                  "version": "0b08c4c499200be67d54c439d56e5ea866869945",
                  "versionType": "git"
                },
                {
                  "lessThan": "6.1.90",
                  "status": "affected",
                  "version": "6.1.28",
                  "versionType": "semver"
                },
                {
                  "lessThan": "6.3",
                  "status": "affected",
                  "version": "6.2.15",
                  "versionType": "semver"
                },
                {
                  "lessThan": "6.4",
                  "status": "affected",
                  "version": "6.3.2",
                  "versionType": "semver"
                }
              ]
            },
            {
              "defaultStatus": "affected",
              "product": "Linux",
              "programFiles": [
                "fs/smb/client/transport.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "status": "affected",
                  "version": "6.4"
                },
                {
                  "lessThan": "6.4",
                  "status": "unaffected",
                  "version": "0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.1.*",
                  "status": "unaffected",
                  "version": "6.1.90",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.6.*",
                  "status": "unaffected",
                  "version": "6.6.30",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.8.*",
                  "status": "unaffected",
                  "version": "6.8.9",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "*",
                  "status": "unaffected",
                  "version": "6.9",
                  "versionType": "original_commit_for_fix"
                }
              ]
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.1.90",
                      "versionStartIncluding": "6.1.28",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.6.30",
                      "versionStartIncluding": "6.4",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.8.9",
                      "versionStartIncluding": "6.4",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.9",
                      "versionStartIncluding": "6.4",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionStartIncluding": "6.2.15",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionStartIncluding": "6.3.2",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb3: fix lock ordering potential deadlock in cifs_sync_mid_result\n\nCoverity spotted that the cifs_sync_mid_result function could deadlock\n\n\"Thread deadlock (ORDER_REVERSAL) lock_order: Calling spin_lock acquires\nlock TCP_Server_Info.srv_lock while holding lock TCP_Server_Info.mid_lock\"\n\nAddresses-Coverity: 1590401 (\"Thread deadlock (ORDER_REVERSAL)\")"
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "scenarios": [
                {
                  "lang": "en",
                  "value": "AV:N - Both halves of the lock-order reversal are driven by SMB3 response frames received from the remote server \u2014 `smb2_decrypt_offload()` runs on server-supplied encrypted read payloads, and the mid states examined in `cifs_sync_mid_result()` are set solely by response parsing (`dequeue_mid()`, `handle_read_data()`). A malicious, compromised, or MITM\u0027d SMB server reaches the code purely over the network, matching this CNA\u0027s AV:N treatment of other cifs-client bugs (CVE-2024-39468, CVE-2024-42256).\nAC:L - The remote server controls both sides of the race \u2014 it chooses response size, encryption, timing, and error status, so it can drive `smb2_decrypt_offload()` into its `srv_lock`\u2192`mid_lock` branch on one CPU while forcing an unexpected mid state into `cifs_sync_mid_result()`\u0027s `mid_lock`\u2192`srv_lock` path on another, and it can repeat this indefinitely. Where the attacker creates the race, AC is Low.\nPR:N - The attacker is the remote SMB peer (or a network attacker able to spoof/hijack the SMB connection); no account, credential, or local privilege on the victim host is required to send the responses that trigger the deadlock.\nUI:N - Exploitation needs no victim action \u2014 the CIFS share is already mounted as a normal deployment condition (fstab/automount), and ordinary background I/O supplies the requests whose responses the attacker manipulates.\nS:U - The deadlock is confined to the kernel of the affected client machine; no VM, IOMMU, or sandbox boundary is crossed.\nC:N - The bug is purely a lock acquisition-order violation \u2014 no memory is read out of bounds, no freed object is accessed, and no data is disclosed.\nI:N - No memory corruption, out-of-bounds write, or data modification occurs; the flaw only affects the order in which two spinlocks are taken.\nA:H - An ABBA deadlock on `srv_lock`/`mid_lock` permanently wedges two CPUs spinning with preemption disabled while holding both locks, hanging all CIFS I/O and every subsequent taker of either lock, resulting in a hard lockup/panic."
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-05T11:31:29.368Z",
            "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "shortName": "Linux"
          },
          "references": [
            {
              "url": "https://git.kernel.org/stable/c/c7a4bca289e50bb4b2650f845c41bb3e453f4c66"
            },
            {
              "url": "https://git.kernel.org/stable/c/699f8958dece132709c0bff6a9700999a2a63b75"
            },
            {
              "url": "https://git.kernel.org/stable/c/8248224ab5b8ca7559b671917c224296a4d671fc"
            },
            {
              "url": "https://git.kernel.org/stable/c/8861fd5180476f45f9e8853db154600469a0284f"
            }
          ],
          "title": "smb3: fix lock ordering potential deadlock in cifs_sync_mid_result",
          "x_generator": {
            "engine": "bippy-1.2.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "assignerShortName": "Linux",
        "cveId": "CVE-2024-35998",
        "datePublished": "2024-05-20T09:48:01.009Z",
        "dateReserved": "2024-05-17T13:50:33.148Z",
        "dateUpdated": "2026-08-05T11:31:29.368Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.