GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2024-49864 (GCVE-0-2024-49864)

Vulnerability from cvelistv5 – Published: 2024-10-21 18:01 – Updated: 2026-08-05 11:40
VLAI
Title
rxrpc: Fix a race between socket set up and I/O thread creation
Summary
In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix a race between socket set up and I/O thread creation In rxrpc_open_socket(), it sets up the socket and then sets up the I/O thread that will handle it. This is a problem, however, as there's a gap between the two phases in which a packet may come into rxrpc_encap_rcv() from the UDP packet but we oops when trying to wake the not-yet created I/O thread. As a quick fix, just make rxrpc_encap_rcv() discard the packet if there's no I/O thread yet. A better, but more intrusive fix would perhaps be to rearrange things such that the socket creation is done by the I/O thread.
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-10-22 13:47 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: a275da62e8c111b897b9cb73eb91df2f4e475ca5 , < cdf4bbbdb956d7426f687f38757ebca2a2759a0f (git)
Affected: a275da62e8c111b897b9cb73eb91df2f4e475ca5 , < 56e415202b8a17de6496f4023e545fcb66f118ec (git)
Affected: a275da62e8c111b897b9cb73eb91df2f4e475ca5 , < c64f5fc95e9612fdf75587c8e21e494e614c18e2 (git)
Affected: a275da62e8c111b897b9cb73eb91df2f4e475ca5 , < bc212465326e8587325f520a052346f0b57360e6 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.2
Unaffected: 0 , < 6.2 (semver)
Unaffected: 6.6.55 , ≤ 6.6.* (semver)
Unaffected: 6.10.14 , ≤ 6.10.* (semver)
Unaffected: 6.11.3 , ≤ 6.11.* (semver)
Unaffected: 6.12 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-49864",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-22T13:47:53.708864Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-22T13:48:52.920Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/rxrpc/ar-internal.h",
            "net/rxrpc/io_thread.c",
            "net/rxrpc/local_object.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "cdf4bbbdb956d7426f687f38757ebca2a2759a0f",
              "status": "affected",
              "version": "a275da62e8c111b897b9cb73eb91df2f4e475ca5",
              "versionType": "git"
            },
            {
              "lessThan": "56e415202b8a17de6496f4023e545fcb66f118ec",
              "status": "affected",
              "version": "a275da62e8c111b897b9cb73eb91df2f4e475ca5",
              "versionType": "git"
            },
            {
              "lessThan": "c64f5fc95e9612fdf75587c8e21e494e614c18e2",
              "status": "affected",
              "version": "a275da62e8c111b897b9cb73eb91df2f4e475ca5",
              "versionType": "git"
            },
            {
              "lessThan": "bc212465326e8587325f520a052346f0b57360e6",
              "status": "affected",
              "version": "a275da62e8c111b897b9cb73eb91df2f4e475ca5",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/rxrpc/ar-internal.h",
            "net/rxrpc/io_thread.c",
            "net/rxrpc/local_object.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.2"
            },
            {
              "lessThan": "6.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.55",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.10.*",
              "status": "unaffected",
              "version": "6.10.14",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.11.*",
              "status": "unaffected",
              "version": "6.11.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.12",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.55",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10.14",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11.3",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nrxrpc: Fix a race between socket set up and I/O thread creation\n\nIn rxrpc_open_socket(), it sets up the socket and then sets up the I/O\nthread that will handle it.  This is a problem, however, as there\u0027s a gap\nbetween the two phases in which a packet may come into rxrpc_encap_rcv()\nfrom the UDP packet but we oops when trying to wake the not-yet created I/O\nthread.\n\nAs a quick fix, just make rxrpc_encap_rcv() discard the packet if there\u0027s\nno I/O thread yet.\n\nA better, but more intrusive fix would perhaps be to rearrange things such\nthat the socket creation is done by the I/O thread."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The vulnerable code is the UDP encapsulation receive handler `rxrpc_encap_rcv()`, entered from the softirq packet-receive path for any datagram delivered to the rxrpc endpoint\u0027s UDP port (e.g. the well-known AFS port 7001 used by kafs). A remote host on the network triggers the oops simply by sending UDP packets to that port.\nAC:L - The race window is wide and deterministically traversed \u2014 it contains a `kthread_run()` plus a blocking `wait_for_completion()` \u2014 so a sustained UDP flood at the target port hits it without any timing precision, and a local attacker controls both sides outright by looping `bind()` on an AF_RXRPC socket while flooding that port on loopback. Repeatable success is expected.\nPR:N - The NULL dereference occurs before any rxrpc header parsing, service-ID matching, connection lookup or security-level check, so no credentials or prior authentication are needed; any unauthenticated packet reaching the port suffices. Even in the purely local variant, `rxrpc_create()` and `rxrpc_bind()` require no capability at all.\nUI:N - Exploitation needs only inbound packets during the endpoint-setup window; no action by any user of the target system is required beyond the normal, automatic creation of the rxrpc endpoint (module load, AFS mount, netns/container creation, service start).\nS:U - The dereference and its consequences are confined to the kernel of the affected host; no VM, IOMMU or other security-authority boundary is crossed.\nC:N - The bug is a dereference of a NULL `task_struct` pointer in `try_to_wake_up()`; no attacker-controlled memory is read back and no kernel data or pointers are disclosed to the attacker.\nI:N - No memory is written out of bounds and no freed object is reused \u2014 the fault is a read of the NULL page, giving the attacker no write or control-flow primitive.\nA:H - The NULL dereference happens in NET_RX softirq context, producing a fatal exception in interrupt context and a full kernel panic; it can be re-triggered on every reboot by keeping the UDP flood running against the endpoint\u0027s port."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:40:12.232Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/cdf4bbbdb956d7426f687f38757ebca2a2759a0f"
        },
        {
          "url": "https://git.kernel.org/stable/c/56e415202b8a17de6496f4023e545fcb66f118ec"
        },
        {
          "url": "https://git.kernel.org/stable/c/c64f5fc95e9612fdf75587c8e21e494e614c18e2"
        },
        {
          "url": "https://git.kernel.org/stable/c/bc212465326e8587325f520a052346f0b57360e6"
        }
      ],
      "title": "rxrpc: Fix a race between socket set up and I/O thread creation",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-49864",
    "datePublished": "2024-10-21T18:01:07.874Z",
    "dateReserved": "2024-10-21T12:17:06.017Z",
    "dateUpdated": "2026-08-05T11:40:12.232Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-49864",
      "date": "2026-09-16",
      "epss": "0.00449",
      "percentile": "0.38163"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.2\", \"versionEndIncluding\": \"6.6.55\", \"matchCriteriaId\": \"B1BFA43F-F661-44FE-AC13-3AAA4257DF12\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.10\", \"versionEndExcluding\": \"6.10.14\", \"matchCriteriaId\": \"20A9A1A8-B921-4FB1-BC2B-00E240DE3643\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.11\", \"versionEndExcluding\": \"6.11.3\", \"matchCriteriaId\": \"54D9C704-D679-41A7-9C40-10A6B1E7FFE9\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.12:rc1:*:*:*:*:*:*\", \"matchCriteriaId\": \"7F361E1D-580F-4A2D-A509-7615F73167A1\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.12:rc2:*:*:*:*:*:*\", \"matchCriteriaId\": \"925478D0-3E3D-4E6F-ACD5-09F28D5DF82C\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nrxrpc: Fix a race between socket set up and I/O thread creation\\n\\nIn rxrpc_open_socket(), it sets up the socket and then sets up the I/O\\nthread that will handle it.  This is a problem, however, as there\u0027s a gap\\nbetween the two phases in which a packet may come into rxrpc_encap_rcv()\\nfrom the UDP packet but we oops when trying to wake the not-yet created I/O\\nthread.\\n\\nAs a quick fix, just make rxrpc_encap_rcv() discard the packet if there\u0027s\\nno I/O thread yet.\\n\\nA better, but more intrusive fix would perhaps be to rearrange things such\\nthat the socket creation is done by the I/O thread.\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: rxrpc: Corrige una ejecuci\\u00f3n entre la configuraci\\u00f3n del socket y la creaci\\u00f3n del hilo de E/S En rxrpc_open_socket(), configura el socket y luego configura el hilo de E/S que lo manejar\\u00e1. Sin embargo, esto es un problema, ya que hay una brecha entre las dos fases en las que un paquete puede llegar a rxrpc_encap_rcv() desde el paquete UDP, pero fallo al intentar despertar el hilo de E/S a\\u00fan no creado. Como soluci\\u00f3n r\\u00e1pida, simplemente haga que rxrpc_encap_rcv() descarte el paquete si a\\u00fan no hay un hilo de E/S. Una soluci\\u00f3n mejor, pero m\\u00e1s intrusiva, tal vez ser\\u00eda reorganizar las cosas de modo que la creaci\\u00f3n del socket la realice el hilo de E/S.\"}]",
      "id": "CVE-2024-49864",
      "lastModified": "2024-11-13T14:23:48.437",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"baseScore\": 4.7, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.0, \"impactScore\": 3.6}]}",
      "published": "2024-10-21T18:15:06.203",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/56e415202b8a17de6496f4023e545fcb66f118ec\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/bc212465326e8587325f520a052346f0b57360e6\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/c64f5fc95e9612fdf75587c8e21e494e614c18e2\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/cdf4bbbdb956d7426f687f38757ebca2a2759a0f\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Analyzed",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-362\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-49864\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-10-21T18:15:06.203\",\"lastModified\":\"2026-08-04T11:20:53.083\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nrxrpc: Fix a race between socket set up and I/O thread creation\\n\\nIn rxrpc_open_socket(), it sets up the socket and then sets up the I/O\\nthread that will handle it.  This is a problem, however, as there\u0027s a gap\\nbetween the two phases in which a packet may come into rxrpc_encap_rcv()\\nfrom the UDP packet but we oops when trying to wake the not-yet created I/O\\nthread.\\n\\nAs a quick fix, just make rxrpc_encap_rcv() discard the packet if there\u0027s\\nno I/O thread yet.\\n\\nA better, but more intrusive fix would perhaps be to rearrange things such\\nthat the socket creation is done by the I/O thread.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: rxrpc: Corrige una ejecuci\u00f3n entre la configuraci\u00f3n del socket y la creaci\u00f3n del hilo de E/S En rxrpc_open_socket(), configura el socket y luego configura el hilo de E/S que lo manejar\u00e1. Sin embargo, esto es un problema, ya que hay una brecha entre las dos fases en las que un paquete puede llegar a rxrpc_encap_rcv() desde el paquete UDP, pero fallo al intentar despertar el hilo de E/S a\u00fan no creado. Como soluci\u00f3n r\u00e1pida, simplemente haga que rxrpc_encap_rcv() descarte el paquete si a\u00fan no hay un hilo de E/S. Una soluci\u00f3n mejor, pero m\u00e1s intrusiva, tal vez ser\u00eda reorganizar las cosas de modo que la creaci\u00f3n del socket la realice el hilo de E/S.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/rxrpc/ar-internal.h\",\"net/rxrpc/io_thread.c\",\"net/rxrpc/local_object.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"a275da62e8c111b897b9cb73eb91df2f4e475ca5\",\"lessThan\":\"cdf4bbbdb956d7426f687f38757ebca2a2759a0f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"a275da62e8c111b897b9cb73eb91df2f4e475ca5\",\"lessThan\":\"56e415202b8a17de6496f4023e545fcb66f118ec\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"a275da62e8c111b897b9cb73eb91df2f4e475ca5\",\"lessThan\":\"c64f5fc95e9612fdf75587c8e21e494e614c18e2\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"a275da62e8c111b897b9cb73eb91df2f4e475ca5\",\"lessThan\":\"bc212465326e8587325f520a052346f0b57360e6\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/rxrpc/ar-internal.h\",\"net/rxrpc/io_thread.c\",\"net/rxrpc/local_object.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.2\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.2\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.55\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.10.14\",\"lessThanOrEqual\":\"6.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.11.3\",\"lessThanOrEqual\":\"6.11.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":4.7,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.0,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-10-22T13:47:53.708864Z\",\"id\":\"CVE-2024-49864\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-362\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndIncluding\":\"6.6.55\",\"matchCriteriaId\":\"B1BFA43F-F661-44FE-AC13-3AAA4257DF12\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.10\",\"versionEndExcluding\":\"6.10.14\",\"matchCriteriaId\":\"20A9A1A8-B921-4FB1-BC2B-00E240DE3643\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.11\",\"versionEndExcluding\":\"6.11.3\",\"matchCriteriaId\":\"54D9C704-D679-41A7-9C40-10A6B1E7FFE9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.12:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"7F361E1D-580F-4A2D-A509-7615F73167A1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.12:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"925478D0-3E3D-4E6F-ACD5-09F28D5DF82C\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/56e415202b8a17de6496f4023e545fcb66f118ec\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/bc212465326e8587325f520a052346f0b57360e6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c64f5fc95e9612fdf75587c8e21e494e614c18e2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/cdf4bbbdb956d7426f687f38757ebca2a2759a0f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-13T10:05:33+00:00",
      "cve": "CVE-2024-49864",
      "id": "CVE-2024-49864",
      "initial_release_date": "2024-10-21T00:00:00+00:00",
      "product_status:fixed": "303",
      "product_status:known_affected": "22",
      "product_status:known_not_affected": "90",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: rxrpc: Fix a race between socket set up and I/O thread creation",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-49864.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-02T01:25:23Z",
      "cve": "CVE-2024-49864",
      "id": "CVE-2024-49864",
      "initial_release_date": "2024-10-25T03:07:37Z",
      "product_status:known_affected": "398",
      "product_status:known_not_affected": "474",
      "product_status:recommended": "408",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-49864",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-49864.json",
      "version": "65"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-49864\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-10-22T13:47:53.708864Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-10-22T13:47:56.974Z\"}}], \"cna\": {\"title\": \"rxrpc: Fix a race between socket set up and I/O thread creation\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.5, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:N - The vulnerable code is the UDP encapsulation receive handler `rxrpc_encap_rcv()`, entered from the softirq packet-receive path for any datagram delivered to the rxrpc endpoint\u0027s UDP port (e.g. the well-known AFS port 7001 used by kafs). A remote host on the network triggers the oops simply by sending UDP packets to that port.\\nAC:L - The race window is wide and deterministically traversed \\u2014 it contains a `kthread_run()` plus a blocking `wait_for_completion()` \\u2014 so a sustained UDP flood at the target port hits it without any timing precision, and a local attacker controls both sides outright by looping `bind()` on an AF_RXRPC socket while flooding that port on loopback. Repeatable success is expected.\\nPR:N - The NULL dereference occurs before any rxrpc header parsing, service-ID matching, connection lookup or security-level check, so no credentials or prior authentication are needed; any unauthenticated packet reaching the port suffices. Even in the purely local variant, `rxrpc_create()` and `rxrpc_bind()` require no capability at all.\\nUI:N - Exploitation needs only inbound packets during the endpoint-setup window; no action by any user of the target system is required beyond the normal, automatic creation of the rxrpc endpoint (module load, AFS mount, netns/container creation, service start).\\nS:U - The dereference and its consequences are confined to the kernel of the affected host; no VM, IOMMU or other security-authority boundary is crossed.\\nC:N - The bug is a dereference of a NULL `task_struct` pointer in `try_to_wake_up()`; no attacker-controlled memory is read back and no kernel data or pointers are disclosed to the attacker.\\nI:N - No memory is written out of bounds and no freed object is reused \\u2014 the fault is a read of the NULL page, giving the attacker no write or control-flow primitive.\\nA:H - The NULL dereference happens in NET_RX softirq context, producing a fatal exception in interrupt context and a full kernel panic; it can be re-triggered on every reboot by keeping the UDP flood running against the endpoint\u0027s port.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"a275da62e8c111b897b9cb73eb91df2f4e475ca5\", \"lessThan\": \"cdf4bbbdb956d7426f687f38757ebca2a2759a0f\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"a275da62e8c111b897b9cb73eb91df2f4e475ca5\", \"lessThan\": \"56e415202b8a17de6496f4023e545fcb66f118ec\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"a275da62e8c111b897b9cb73eb91df2f4e475ca5\", \"lessThan\": \"c64f5fc95e9612fdf75587c8e21e494e614c18e2\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"a275da62e8c111b897b9cb73eb91df2f4e475ca5\", \"lessThan\": \"bc212465326e8587325f520a052346f0b57360e6\", \"versionType\": \"git\"}], \"programFiles\": [\"net/rxrpc/ar-internal.h\", \"net/rxrpc/io_thread.c\", \"net/rxrpc/local_object.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.2\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.2\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.6.55\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.10.14\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.10.*\"}, {\"status\": \"unaffected\", \"version\": \"6.11.3\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.11.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"net/rxrpc/ar-internal.h\", \"net/rxrpc/io_thread.c\", \"net/rxrpc/local_object.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/cdf4bbbdb956d7426f687f38757ebca2a2759a0f\"}, {\"url\": \"https://git.kernel.org/stable/c/56e415202b8a17de6496f4023e545fcb66f118ec\"}, {\"url\": \"https://git.kernel.org/stable/c/c64f5fc95e9612fdf75587c8e21e494e614c18e2\"}, {\"url\": \"https://git.kernel.org/stable/c/bc212465326e8587325f520a052346f0b57360e6\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nrxrpc: Fix a race between socket set up and I/O thread creation\\n\\nIn rxrpc_open_socket(), it sets up the socket and then sets up the I/O\\nthread that will handle it.  This is a problem, however, as there\u0027s a gap\\nbetween the two phases in which a packet may come into rxrpc_encap_rcv()\\nfrom the UDP packet but we oops when trying to wake the not-yet created I/O\\nthread.\\n\\nAs a quick fix, just make rxrpc_encap_rcv() discard the packet if there\u0027s\\nno I/O thread yet.\\n\\nA better, but more intrusive fix would perhaps be to rearrange things such\\nthat the socket creation is done by the I/O thread.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.55\", \"versionStartIncluding\": \"6.2\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.10.14\", \"versionStartIncluding\": \"6.2\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.11.3\", \"versionStartIncluding\": \"6.2\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12\", \"versionStartIncluding\": \"6.2\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:40:12.232Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-49864\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:40:12.232Z\", \"dateReserved\": \"2024-10-21T12:17:06.017Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-10-21T18:01:07.874Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.