GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2024-41007 (GCVE-0-2024-41007)

Vulnerability from cvelistv5 – Published: 2024-07-15 08:48 – Updated: 2026-08-05 11:34
VLAI
Title
tcp: avoid too many retransmit packets
Summary
In the Linux kernel, the following vulnerability has been resolved: tcp: avoid too many retransmit packets If a TCP socket is using TCP_USER_TIMEOUT, and the other peer retracted its window to zero, tcp_retransmit_timer() can retransmit a packet every two jiffies (2 ms for HZ=1000), for about 4 minutes after TCP_USER_TIMEOUT has 'expired'. The fix is to make sure tcp_rtx_probe0_timed_out() takes icsk->icsk_user_timeout into account. Before blamed commit, the socket would not timeout after icsk->icsk_user_timeout, but would use standard exponential backoff for the retransmits. Also worth noting that before commit e89688e3e978 ("net: tcp: fix unexcepted socket die when snd_wnd is 0"), the issue would last 2 minutes instead of 4.
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-09-10 17:00 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: b701a99e431db784714c32fc6b68123045714679 , < 7bb7670f92bfbd05fc41a8f9a8f358b7ffed65f4 (git)
Affected: b701a99e431db784714c32fc6b68123045714679 , < d2346fca5bed130dc712f276ac63450201d52969 (git)
Affected: b701a99e431db784714c32fc6b68123045714679 , < 5d7e64d70a11d988553a08239c810a658e841982 (git)
Affected: b701a99e431db784714c32fc6b68123045714679 , < 04317a2471c2f637b4c49cbd0e9c0d04a519f570 (git)
Affected: b701a99e431db784714c32fc6b68123045714679 , < e113cddefa27bbf5a79f72387b8fbd432a61a466 (git)
Affected: b701a99e431db784714c32fc6b68123045714679 , < dfcdd7f89e401d2c6616be90c76c2fac3fa98fde (git)
Affected: b701a99e431db784714c32fc6b68123045714679 , < 66cb64a1d2239cd0309f9b5038b05462570a5be1 (git)
Affected: b701a99e431db784714c32fc6b68123045714679 , < 97a9063518f198ec0adb2ecb89789de342bb8283 (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.19
Unaffected: 0 , < 4.19 (semver)
Unaffected: 4.19.318 , ≤ 4.19.* (semver)
Unaffected: 5.4.280 , ≤ 5.4.* (semver)
Unaffected: 5.10.222 , ≤ 5.10.* (semver)
Unaffected: 5.15.163 , ≤ 5.15.* (semver)
Unaffected: 6.1.100 , ≤ 6.1.* (semver)
Unaffected: 6.6.41 , ≤ 6.6.* (semver)
Unaffected: 6.9.10 , ≤ 6.9.* (semver)
Unaffected: 6.10 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T21:59:11.582Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/7bb7670f92bfbd05fc41a8f9a8f358b7ffed65f4"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/d2346fca5bed130dc712f276ac63450201d52969"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/5d7e64d70a11d988553a08239c810a658e841982"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/04317a2471c2f637b4c49cbd0e9c0d04a519f570"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/e113cddefa27bbf5a79f72387b8fbd432a61a466"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/dfcdd7f89e401d2c6616be90c76c2fac3fa98fde"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/66cb64a1d2239cd0309f9b5038b05462570a5be1"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/97a9063518f198ec0adb2ecb89789de342bb8283"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-41007",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T17:00:52.460807Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:34:18.296Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/ipv4/tcp_timer.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "7bb7670f92bfbd05fc41a8f9a8f358b7ffed65f4",
              "status": "affected",
              "version": "b701a99e431db784714c32fc6b68123045714679",
              "versionType": "git"
            },
            {
              "lessThan": "d2346fca5bed130dc712f276ac63450201d52969",
              "status": "affected",
              "version": "b701a99e431db784714c32fc6b68123045714679",
              "versionType": "git"
            },
            {
              "lessThan": "5d7e64d70a11d988553a08239c810a658e841982",
              "status": "affected",
              "version": "b701a99e431db784714c32fc6b68123045714679",
              "versionType": "git"
            },
            {
              "lessThan": "04317a2471c2f637b4c49cbd0e9c0d04a519f570",
              "status": "affected",
              "version": "b701a99e431db784714c32fc6b68123045714679",
              "versionType": "git"
            },
            {
              "lessThan": "e113cddefa27bbf5a79f72387b8fbd432a61a466",
              "status": "affected",
              "version": "b701a99e431db784714c32fc6b68123045714679",
              "versionType": "git"
            },
            {
              "lessThan": "dfcdd7f89e401d2c6616be90c76c2fac3fa98fde",
              "status": "affected",
              "version": "b701a99e431db784714c32fc6b68123045714679",
              "versionType": "git"
            },
            {
              "lessThan": "66cb64a1d2239cd0309f9b5038b05462570a5be1",
              "status": "affected",
              "version": "b701a99e431db784714c32fc6b68123045714679",
              "versionType": "git"
            },
            {
              "lessThan": "97a9063518f198ec0adb2ecb89789de342bb8283",
              "status": "affected",
              "version": "b701a99e431db784714c32fc6b68123045714679",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/ipv4/tcp_timer.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.19"
            },
            {
              "lessThan": "4.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.318",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.280",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.222",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.163",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.100",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.41",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.9.*",
              "status": "unaffected",
              "version": "6.9.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.10",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.318",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.280",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.222",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.163",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.100",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.41",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9.10",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntcp: avoid too many retransmit packets\n\nIf a TCP socket is using TCP_USER_TIMEOUT, and the other peer\nretracted its window to zero, tcp_retransmit_timer() can\nretransmit a packet every two jiffies (2 ms for HZ=1000),\nfor about 4 minutes after TCP_USER_TIMEOUT has \u0027expired\u0027.\n\nThe fix is to make sure tcp_rtx_probe0_timed_out() takes\nicsk-\u003eicsk_user_timeout into account.\n\nBefore blamed commit, the socket would not timeout after\nicsk-\u003eicsk_user_timeout, but would use standard exponential\nbackoff for the retransmits.\n\nAlso worth noting that before commit e89688e3e978 (\"net: tcp:\nfix unexcepted socket die when snd_wnd is 0\"), the issue\nwould last 2 minutes instead of 4."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The bug is in the core TCP stack (net/ipv4/tcp_timer.c) and is driven entirely by a remote peer\u0027s advertised window and ACKs; no local access is needed. Any remote TCP peer of a socket with TCP_USER_TIMEOUT set (NFS client transports, ocfs2, BPF-sockops-configured connections, gRPC/Envoy/HAProxy/Redis servers) can trigger it.\nAC:L - The attacker fully controls the trigger \u2014 shrink the receive window to zero (stop reading, or use a custom stack) and keep ACKing the zero-window probes to keep tp-\u003ercv_tstamp fresh so tcp_rtx_probe0_timed_out() never aborts. No race, timing luck, or memory-layout dependency; TCP_USER_TIMEOUT being set is a common attacker-independent deployment property (sunrpc sets it unconditionally), i.e. part of the vulnerable configuration.\nPR:N - No authentication or credentials are required \u2014 establishing a TCP connection and getting unacked data in flight (e.g. a banner or a pre-auth response) is sufficient. Locally the same condition is reachable by any unprivileged user via setsockopt(TCP_USER_TIMEOUT), which has no capability check.\nUI:N - The packet storm is generated autonomously by the kernel retransmit timer once the peer advertises a zero window. No action by any local user or administrator is needed.\nS:U - The CPU, softirq and network-bandwidth exhaustion stay within the affected host\u0027s own security authority. No privilege or virtualization boundary is crossed.\nC:N - The bug only causes excessive retransmission of data already queued for and destined to that same peer \u2014 no out-of-bounds read, uninitialized memory, or kernel-pointer exposure. The only extra output is an already-existing net_dbg_ratelimited() message.\nI:N - There is no memory corruption, out-of-bounds write, or type confusion; the emitted packets are legitimate, correctly-formed retransmissions. No kernel or user data is modified.\nA:H - tcp_clamp_rto_to_user_timeout() pins the retransmit timer to 1 jiffy, producing 500\u20131000 packets/sec per socket, each with a tcp_enter_loss() and a __sk_dst_reset() route lookup, and a peer that keeps ACKing probes makes this unbounded in time rather than the 4 minutes noted in the changelog. Scaled across many connections this is a sustained, unauthenticated CPU and link-saturation denial of service, and the socket also silently ignores the TCP_USER_TIMEOUT the application relies on for failure detection."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:34:33.523Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/7bb7670f92bfbd05fc41a8f9a8f358b7ffed65f4"
        },
        {
          "url": "https://git.kernel.org/stable/c/d2346fca5bed130dc712f276ac63450201d52969"
        },
        {
          "url": "https://git.kernel.org/stable/c/5d7e64d70a11d988553a08239c810a658e841982"
        },
        {
          "url": "https://git.kernel.org/stable/c/04317a2471c2f637b4c49cbd0e9c0d04a519f570"
        },
        {
          "url": "https://git.kernel.org/stable/c/e113cddefa27bbf5a79f72387b8fbd432a61a466"
        },
        {
          "url": "https://git.kernel.org/stable/c/dfcdd7f89e401d2c6616be90c76c2fac3fa98fde"
        },
        {
          "url": "https://git.kernel.org/stable/c/66cb64a1d2239cd0309f9b5038b05462570a5be1"
        },
        {
          "url": "https://git.kernel.org/stable/c/97a9063518f198ec0adb2ecb89789de342bb8283"
        }
      ],
      "title": "tcp: avoid too many retransmit packets",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-41007",
    "datePublished": "2024-07-15T08:48:10.174Z",
    "dateReserved": "2024-07-12T12:17:45.610Z",
    "dateUpdated": "2026-08-05T11:34:33.523Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-41007",
      "date": "2026-09-16",
      "epss": "0.00773",
      "percentile": "0.53966"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"4.19\", \"versionEndExcluding\": \"5.4.280\", \"matchCriteriaId\": \"EDB3F5FC-7B58-42A1-96EF-E53AF464227C\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.5\", \"versionEndExcluding\": \"5.10.222\", \"matchCriteriaId\": \"00696AC5-EE29-437F-97F9-C4D66608B327\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.11\", \"versionEndExcluding\": \"5.15.163\", \"matchCriteriaId\": \"A97DEB09-4927-40F8-B5C6-F5BD5EAE0CFD\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.16\", \"versionEndExcluding\": \"6.1.100\", \"matchCriteriaId\": \"100CDF74-4DB5-4FC6-A54B-BDBDB0C27137\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.2\", \"versionEndExcluding\": \"6.6.41\", \"matchCriteriaId\": \"96AC42B8-D66D-4AC5-B466-E9BA7910FA29\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.7\", \"versionEndExcluding\": \"6.9.10\", \"matchCriteriaId\": \"AB2E8DEC-CFD5-4C2B-981D-E7E45A36C352\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ntcp: avoid too many retransmit packets\\n\\nIf a TCP socket is using TCP_USER_TIMEOUT, and the other peer\\nretracted its window to zero, tcp_retransmit_timer() can\\nretransmit a packet every two jiffies (2 ms for HZ=1000),\\nfor about 4 minutes after TCP_USER_TIMEOUT has \u0027expired\u0027.\\n\\nThe fix is to make sure tcp_rtx_probe0_timed_out() takes\\nicsk-\u003eicsk_user_timeout into account.\\n\\nBefore blamed commit, the socket would not timeout after\\nicsk-\u003eicsk_user_timeout, but would use standard exponential\\nbackoff for the retransmits.\\n\\nAlso worth noting that before commit e89688e3e978 (\\\"net: tcp:\\nfix unexcepted socket die when snd_wnd is 0\\\"), the issue\\nwould last 2 minutes instead of 4.\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: tcp: evitar demasiados paquetes de retransmisi\\u00f3n Si un socket TCP est\\u00e1 usando TCP_USER_TIMEOUT y el otro par retrajo su ventana a cero, tcp_retransmit_timer() puede retransmitir un paquete cada dos santiam\\u00e9n (2 ms). para HZ=1000), durante aproximadamente 4 minutos despu\\u00e9s de que TCP_USER_TIMEOUT haya \u0027expirado\u0027. La soluci\\u00f3n es asegurarse de que tcp_rtx_probe0_timed_out() tenga en cuenta icsk-\u0026gt;icsk_user_timeout. Antes de el commit culpable, el socket no expiraba despu\\u00e9s de icsk-\u0026gt;icsk_user_timeout, sino que usaba un retroceso exponencial est\\u00e1ndar para las retransmisiones. Tambi\\u00e9n vale la pena se\\u00f1alar que antes de commit e89688e3e978 (\\\"net: tcp: fix unexcepted socket die cuando snd_wnd es 0\\\"), el problema durar\\u00eda 2 minutos en lugar de 4.\"}]",
      "id": "CVE-2024-41007",
      "lastModified": "2024-11-21T09:32:03.210",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L\", \"baseScore\": 3.3, \"baseSeverity\": \"LOW\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"LOW\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 1.4}]}",
      "published": "2024-07-15T09:15:02.803",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/04317a2471c2f637b4c49cbd0e9c0d04a519f570\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/5d7e64d70a11d988553a08239c810a658e841982\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/66cb64a1d2239cd0309f9b5038b05462570a5be1\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/7bb7670f92bfbd05fc41a8f9a8f358b7ffed65f4\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/97a9063518f198ec0adb2ecb89789de342bb8283\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/d2346fca5bed130dc712f276ac63450201d52969\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/dfcdd7f89e401d2c6616be90c76c2fac3fa98fde\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/e113cddefa27bbf5a79f72387b8fbd432a61a466\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/04317a2471c2f637b4c49cbd0e9c0d04a519f570\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/5d7e64d70a11d988553a08239c810a658e841982\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/66cb64a1d2239cd0309f9b5038b05462570a5be1\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/7bb7670f92bfbd05fc41a8f9a8f358b7ffed65f4\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/97a9063518f198ec0adb2ecb89789de342bb8283\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/d2346fca5bed130dc712f276ac63450201d52969\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/dfcdd7f89e401d2c6616be90c76c2fac3fa98fde\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/e113cddefa27bbf5a79f72387b8fbd432a61a466\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"NVD-CWE-noinfo\"}]}]"
    },
    "microsoft_vex": {
      "current_release_date": "2026-02-18T01:46:25.000Z",
      "cve": "CVE-2024-41007",
      "id": "msrc_CVE-2024-41007",
      "initial_release_date": "2024-07-01T07:00:00.000Z",
      "product_status:fixed": "5",
      "product_status:known_affected": "5",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "tcp: avoid too many retransmit packets",
      "url": "https://msrc.microsoft.com/csaf/vex/2024/msrc_cve-2024-41007.json",
      "version": "3"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-41007\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-07-15T09:15:02.803\",\"lastModified\":\"2026-08-04T11:19:15.000\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ntcp: avoid too many retransmit packets\\n\\nIf a TCP socket is using TCP_USER_TIMEOUT, and the other peer\\nretracted its window to zero, tcp_retransmit_timer() can\\nretransmit a packet every two jiffies (2 ms for HZ=1000),\\nfor about 4 minutes after TCP_USER_TIMEOUT has \u0027expired\u0027.\\n\\nThe fix is to make sure tcp_rtx_probe0_timed_out() takes\\nicsk-\u003eicsk_user_timeout into account.\\n\\nBefore blamed commit, the socket would not timeout after\\nicsk-\u003eicsk_user_timeout, but would use standard exponential\\nbackoff for the retransmits.\\n\\nAlso worth noting that before commit e89688e3e978 (\\\"net: tcp:\\nfix unexcepted socket die when snd_wnd is 0\\\"), the issue\\nwould last 2 minutes instead of 4.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: tcp: evitar demasiados paquetes de retransmisi\u00f3n Si un socket TCP est\u00e1 usando TCP_USER_TIMEOUT y el otro par retrajo su ventana a cero, tcp_retransmit_timer() puede retransmitir un paquete cada dos santiam\u00e9n (2 ms). para HZ=1000), durante aproximadamente 4 minutos despu\u00e9s de que TCP_USER_TIMEOUT haya \u0027expirado\u0027. La soluci\u00f3n es asegurarse de que tcp_rtx_probe0_timed_out() tenga en cuenta icsk-\u0026gt;icsk_user_timeout. Antes de el commit culpable, el socket no expiraba despu\u00e9s de icsk-\u0026gt;icsk_user_timeout, sino que usaba un retroceso exponencial est\u00e1ndar para las retransmisiones. Tambi\u00e9n vale la pena se\u00f1alar que antes de commit e89688e3e978 (\\\"net: tcp: fix unexcepted socket die cuando snd_wnd es 0\\\"), el problema durar\u00eda 2 minutos en lugar de 4.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/ipv4/tcp_timer.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"b701a99e431db784714c32fc6b68123045714679\",\"lessThan\":\"7bb7670f92bfbd05fc41a8f9a8f358b7ffed65f4\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b701a99e431db784714c32fc6b68123045714679\",\"lessThan\":\"d2346fca5bed130dc712f276ac63450201d52969\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b701a99e431db784714c32fc6b68123045714679\",\"lessThan\":\"5d7e64d70a11d988553a08239c810a658e841982\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b701a99e431db784714c32fc6b68123045714679\",\"lessThan\":\"04317a2471c2f637b4c49cbd0e9c0d04a519f570\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b701a99e431db784714c32fc6b68123045714679\",\"lessThan\":\"e113cddefa27bbf5a79f72387b8fbd432a61a466\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b701a99e431db784714c32fc6b68123045714679\",\"lessThan\":\"dfcdd7f89e401d2c6616be90c76c2fac3fa98fde\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b701a99e431db784714c32fc6b68123045714679\",\"lessThan\":\"66cb64a1d2239cd0309f9b5038b05462570a5be1\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b701a99e431db784714c32fc6b68123045714679\",\"lessThan\":\"97a9063518f198ec0adb2ecb89789de342bb8283\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/ipv4/tcp_timer.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.19\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.19\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"4.19.318\",\"lessThanOrEqual\":\"4.19.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.4.280\",\"lessThanOrEqual\":\"5.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.222\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.163\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.100\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.41\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.9.10\",\"lessThanOrEqual\":\"6.9.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.10\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L\",\"baseScore\":3.3,\"baseSeverity\":\"LOW\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"LOW\"},\"exploitabilityScore\":1.8,\"impactScore\":1.4}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-09-10T17:00:52.460807Z\",\"id\":\"CVE-2024-41007\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.19\",\"versionEndExcluding\":\"5.4.280\",\"matchCriteriaId\":\"EDB3F5FC-7B58-42A1-96EF-E53AF464227C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.5\",\"versionEndExcluding\":\"5.10.222\",\"matchCriteriaId\":\"00696AC5-EE29-437F-97F9-C4D66608B327\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.163\",\"matchCriteriaId\":\"A97DEB09-4927-40F8-B5C6-F5BD5EAE0CFD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.100\",\"matchCriteriaId\":\"100CDF74-4DB5-4FC6-A54B-BDBDB0C27137\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.41\",\"matchCriteriaId\":\"96AC42B8-D66D-4AC5-B466-E9BA7910FA29\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.9.10\",\"matchCriteriaId\":\"AB2E8DEC-CFD5-4C2B-981D-E7E45A36C352\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/04317a2471c2f637b4c49cbd0e9c0d04a519f570\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/5d7e64d70a11d988553a08239c810a658e841982\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/66cb64a1d2239cd0309f9b5038b05462570a5be1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/7bb7670f92bfbd05fc41a8f9a8f358b7ffed65f4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/97a9063518f198ec0adb2ecb89789de342bb8283\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d2346fca5bed130dc712f276ac63450201d52969\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/dfcdd7f89e401d2c6616be90c76c2fac3fa98fde\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e113cddefa27bbf5a79f72387b8fbd432a61a466\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/04317a2471c2f637b4c49cbd0e9c0d04a519f570\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/5d7e64d70a11d988553a08239c810a658e841982\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/66cb64a1d2239cd0309f9b5038b05462570a5be1\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/7bb7670f92bfbd05fc41a8f9a8f358b7ffed65f4\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/97a9063518f198ec0adb2ecb89789de342bb8283\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d2346fca5bed130dc712f276ac63450201d52969\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/dfcdd7f89e401d2c6616be90c76c2fac3fa98fde\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e113cddefa27bbf5a79f72387b8fbd432a61a466\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T18:38:07+00:00",
      "cve": "CVE-2024-41007",
      "id": "CVE-2024-41007",
      "initial_release_date": "2024-07-15T00:00:00+00:00",
      "product_status:fixed": "709",
      "product_status:known_affected": "64",
      "product_status:known_not_affected": "8",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: tcp: avoid too many retransmit packets",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-41007.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "low",
      "current_release_date": "2026-09-03T00:22:58Z",
      "cve": "CVE-2024-41007",
      "id": "CVE-2024-41007",
      "initial_release_date": "2024-07-16T02:33:41Z",
      "product_status:known_affected": "489",
      "product_status:known_not_affected": "139",
      "product_status:recommended": "700",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-41007",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-41007.json",
      "version": "76"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/7bb7670f92bfbd05fc41a8f9a8f358b7ffed65f4\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/d2346fca5bed130dc712f276ac63450201d52969\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/5d7e64d70a11d988553a08239c810a658e841982\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/04317a2471c2f637b4c49cbd0e9c0d04a519f570\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/e113cddefa27bbf5a79f72387b8fbd432a61a466\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/dfcdd7f89e401d2c6616be90c76c2fac3fa98fde\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/66cb64a1d2239cd0309f9b5038b05462570a5be1\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/97a9063518f198ec0adb2ecb89789de342bb8283\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-11-03T21:59:11.582Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-41007\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-10T17:00:52.460807Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-11T12:42:21.889Z\"}}], \"cna\": {\"title\": \"tcp: avoid too many retransmit packets\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.5, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:N - The bug is in the core TCP stack (net/ipv4/tcp_timer.c) and is driven entirely by a remote peer\u0027s advertised window and ACKs; no local access is needed. Any remote TCP peer of a socket with TCP_USER_TIMEOUT set (NFS client transports, ocfs2, BPF-sockops-configured connections, gRPC/Envoy/HAProxy/Redis servers) can trigger it.\\nAC:L - The attacker fully controls the trigger \\u2014 shrink the receive window to zero (stop reading, or use a custom stack) and keep ACKing the zero-window probes to keep tp-\u003ercv_tstamp fresh so tcp_rtx_probe0_timed_out() never aborts. No race, timing luck, or memory-layout dependency; TCP_USER_TIMEOUT being set is a common attacker-independent deployment property (sunrpc sets it unconditionally), i.e. part of the vulnerable configuration.\\nPR:N - No authentication or credentials are required \\u2014 establishing a TCP connection and getting unacked data in flight (e.g. a banner or a pre-auth response) is sufficient. Locally the same condition is reachable by any unprivileged user via setsockopt(TCP_USER_TIMEOUT), which has no capability check.\\nUI:N - The packet storm is generated autonomously by the kernel retransmit timer once the peer advertises a zero window. No action by any local user or administrator is needed.\\nS:U - The CPU, softirq and network-bandwidth exhaustion stay within the affected host\u0027s own security authority. No privilege or virtualization boundary is crossed.\\nC:N - The bug only causes excessive retransmission of data already queued for and destined to that same peer \\u2014 no out-of-bounds read, uninitialized memory, or kernel-pointer exposure. The only extra output is an already-existing net_dbg_ratelimited() message.\\nI:N - There is no memory corruption, out-of-bounds write, or type confusion; the emitted packets are legitimate, correctly-formed retransmissions. No kernel or user data is modified.\\nA:H - tcp_clamp_rto_to_user_timeout() pins the retransmit timer to 1 jiffy, producing 500\\u20131000 packets/sec per socket, each with a tcp_enter_loss() and a __sk_dst_reset() route lookup, and a peer that keeps ACKing probes makes this unbounded in time rather than the 4 minutes noted in the changelog. Scaled across many connections this is a sustained, unauthenticated CPU and link-saturation denial of service, and the socket also silently ignores the TCP_USER_TIMEOUT the application relies on for failure detection.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"b701a99e431db784714c32fc6b68123045714679\", \"lessThan\": \"7bb7670f92bfbd05fc41a8f9a8f358b7ffed65f4\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"b701a99e431db784714c32fc6b68123045714679\", \"lessThan\": \"d2346fca5bed130dc712f276ac63450201d52969\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"b701a99e431db784714c32fc6b68123045714679\", \"lessThan\": \"5d7e64d70a11d988553a08239c810a658e841982\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"b701a99e431db784714c32fc6b68123045714679\", \"lessThan\": \"04317a2471c2f637b4c49cbd0e9c0d04a519f570\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"b701a99e431db784714c32fc6b68123045714679\", \"lessThan\": \"e113cddefa27bbf5a79f72387b8fbd432a61a466\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"b701a99e431db784714c32fc6b68123045714679\", \"lessThan\": \"dfcdd7f89e401d2c6616be90c76c2fac3fa98fde\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"b701a99e431db784714c32fc6b68123045714679\", \"lessThan\": \"66cb64a1d2239cd0309f9b5038b05462570a5be1\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"b701a99e431db784714c32fc6b68123045714679\", \"lessThan\": \"97a9063518f198ec0adb2ecb89789de342bb8283\", \"versionType\": \"git\"}], \"programFiles\": [\"net/ipv4/tcp_timer.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.19\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"4.19\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"4.19.318\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"4.19.*\"}, {\"status\": \"unaffected\", \"version\": \"5.4.280\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.4.*\"}, {\"status\": \"unaffected\", \"version\": \"5.10.222\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.163\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.100\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.41\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.9.10\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.9.*\"}, {\"status\": \"unaffected\", \"version\": \"6.10\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"net/ipv4/tcp_timer.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/7bb7670f92bfbd05fc41a8f9a8f358b7ffed65f4\"}, {\"url\": \"https://git.kernel.org/stable/c/d2346fca5bed130dc712f276ac63450201d52969\"}, {\"url\": \"https://git.kernel.org/stable/c/5d7e64d70a11d988553a08239c810a658e841982\"}, {\"url\": \"https://git.kernel.org/stable/c/04317a2471c2f637b4c49cbd0e9c0d04a519f570\"}, {\"url\": \"https://git.kernel.org/stable/c/e113cddefa27bbf5a79f72387b8fbd432a61a466\"}, {\"url\": \"https://git.kernel.org/stable/c/dfcdd7f89e401d2c6616be90c76c2fac3fa98fde\"}, {\"url\": \"https://git.kernel.org/stable/c/66cb64a1d2239cd0309f9b5038b05462570a5be1\"}, {\"url\": \"https://git.kernel.org/stable/c/97a9063518f198ec0adb2ecb89789de342bb8283\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ntcp: avoid too many retransmit packets\\n\\nIf a TCP socket is using TCP_USER_TIMEOUT, and the other peer\\nretracted its window to zero, tcp_retransmit_timer() can\\nretransmit a packet every two jiffies (2 ms for HZ=1000),\\nfor about 4 minutes after TCP_USER_TIMEOUT has \u0027expired\u0027.\\n\\nThe fix is to make sure tcp_rtx_probe0_timed_out() takes\\nicsk-\u003eicsk_user_timeout into account.\\n\\nBefore blamed commit, the socket would not timeout after\\nicsk-\u003eicsk_user_timeout, but would use standard exponential\\nbackoff for the retransmits.\\n\\nAlso worth noting that before commit e89688e3e978 (\\\"net: tcp:\\nfix unexcepted socket die when snd_wnd is 0\\\"), the issue\\nwould last 2 minutes instead of 4.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"4.19.318\", \"versionStartIncluding\": \"4.19\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.4.280\", \"versionStartIncluding\": \"4.19\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.222\", \"versionStartIncluding\": \"4.19\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.163\", \"versionStartIncluding\": \"4.19\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.100\", \"versionStartIncluding\": \"4.19\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.41\", \"versionStartIncluding\": \"4.19\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.9.10\", \"versionStartIncluding\": \"4.19\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.10\", \"versionStartIncluding\": \"4.19\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:34:33.523Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-41007\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:34:33.523Z\", \"dateReserved\": \"2024-07-12T12:17:45.610Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-07-15T08:48:10.174Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.