tcp: properly terminate timers for kernel sockets

MITRE NVD CVE.ORG JSON API

Summary

CVECVE-2024-35910
StatePUBLISHED
AssignerLinux
Source PriorityCVE Program / NVD first with legacy fallback
Published2024-05-19 09:15:11 UTC
Updated2026-05-12 12:16:40 UTC
DescriptionIn the Linux kernel, the following vulnerability has been resolved: tcp: properly terminate timers for kernel sockets We had various syzbot reports about tcp timers firing after the corresponding netns has been dismantled. Fortunately Josef Bacik could trigger the issue more often, and could test a patch I wrote two years ago. When TCP sockets are closed, we call inet_csk_clear_xmit_timers() to 'stop' the timers. inet_csk_clear_xmit_timers() can be called from any context, including when socket lock is held. This is the reason it uses sk_stop_timer(), aka del_timer(). This means that ongoing timers might finish much later. For user sockets, this is fine because each running timer holds a reference on the socket, and the user socket holds a reference on the netns. For kernel sockets, we risk that the netns is freed before timer can complete, because kernel sockets do not hold reference on the netns. This patch adds inet_csk_clear_xmit_timers_sync() function that using sk_stop_timer_sync() to make sure all timers are terminated before the kernel socket is released. Modules using kernel sockets close them in their netns exit() handler. Also add sock_not_owned_by_me() helper to get LOCKDEP support : inet_csk_clear_xmit_timers_sync() must not be called while socket lock is held. It is very possible we can revert in the future commit 3a58f13a881e ("net: rds: acquire refcount on TCP sockets") which attempted to solve the issue in rds only. (net/smc/af_smc.c and net/mptcp/subflow.c have similar code) We probably can remove the check_net() tests from tcp_out_of_resources() and __tcp_close() in the future.

Risk And Classification

Primary CVSS: v3.1 5.8 MEDIUM from [email protected]

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H

Problem Types: NVD-CWE-noinfo | CWE-noinfo Not enough information

VersionSourceTypeScoreSeverityVector
3.1[email protected]Primary5.8MEDIUMCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H
3.1ADPDECLARED5.8MEDIUMCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H
3.1134c704f-9b21-4f2e-91b3-4a467353bcc0Secondary5.8MEDIUMCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H

CVSS v3.1 Breakdown

Attack Vector
Local
Attack Complexity
High
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
High

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H

NVD Known Affected Configurations (CPE 2.3)

TypeVendorProductVersionUpdateEditionLanguage
Operating System Linux Linux Kernel All All All All

Vendor Declared Affected Products

SourceVendorProductVersionPlatforms
CNA Linux Linux affected 26abe14379f8e2fa3fd1bcf97c9a7ad9364886fe 93f0133b9d589cc6e865f254ad9be3e9d8133f50 git Not specified
CNA Linux Linux affected 26abe14379f8e2fa3fd1bcf97c9a7ad9364886fe 44e62f5d35678686734afd47c6a421ad30772e7f git Not specified
CNA Linux Linux affected 26abe14379f8e2fa3fd1bcf97c9a7ad9364886fe e3e27d2b446deb1f643758a0c4731f5c22492810 git Not specified
CNA Linux Linux affected 26abe14379f8e2fa3fd1bcf97c9a7ad9364886fe 2e43d8eba6edd1cf05a3a20fdd77688fa7ec16a4 git Not specified
CNA Linux Linux affected 26abe14379f8e2fa3fd1bcf97c9a7ad9364886fe 91b243de910a9ac8476d40238ab3dbfeedd5b7de git Not specified
CNA Linux Linux affected 26abe14379f8e2fa3fd1bcf97c9a7ad9364886fe c1ae4d1e76eacddaacb958b67cd942082f800c87 git Not specified
CNA Linux Linux affected 26abe14379f8e2fa3fd1bcf97c9a7ad9364886fe 899265c1389fe022802aae73dbf13ee08837a35a git Not specified
CNA Linux Linux affected 26abe14379f8e2fa3fd1bcf97c9a7ad9364886fe 151c9c724d05d5b0dd8acd3e11cb69ef1f2dbada git Not specified
CNA Linux Linux affected 4.2 Not specified
CNA Linux Linux unaffected 4.2 semver Not specified
CNA Linux Linux unaffected 4.19.312 4.19.* semver Not specified
CNA Linux Linux unaffected 5.4.274 5.4.* semver Not specified
CNA Linux Linux unaffected 5.10.215 5.10.* semver Not specified
CNA Linux Linux unaffected 5.15.154 5.15.* semver Not specified
CNA Linux Linux unaffected 6.1.85 6.1.* semver Not specified
CNA Linux Linux unaffected 6.6.26 6.6.* semver Not specified
CNA Linux Linux unaffected 6.8.5 6.8.* semver Not specified
CNA Linux Linux unaffected 6.9 * original_commit_for_fix Not specified
ADP Siemens SIMATIC S7-1500 TM MFP - GNU/Linux Subsystem affected * custom Not specified
ADP Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP affected V3.1.0 V3.1.5 custom Not specified
ADP Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP affected V3.1.0 V3.1.5 custom Not specified
ADP Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP affected V3.1.0 V3.1.5 custom Not specified
ADP Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP affected V3.1.0 V3.1.5 custom Not specified
ADP Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP affected V3.1.0 V3.1.5 custom Not specified

References

ReferenceSourceLinkTags
cert-portal.siemens.com/productcert/html/ssa-398330.html 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e cert-portal.siemens.com
git.kernel.org/stable/c/91b243de910a9ac8476d40238ab3dbfeedd5b7de af854a3a-2127-422b-91ae-364da2661108 git.kernel.org Patch
lists.debian.org/debian-lts-announce/2024/06/msg00017.html af854a3a-2127-422b-91ae-364da2661108 lists.debian.org Mailing List, Third Party Advisory
cert-portal.siemens.com/productcert/html/ssa-265688.html 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e cert-portal.siemens.com
git.kernel.org/stable/c/151c9c724d05d5b0dd8acd3e11cb69ef1f2dbada af854a3a-2127-422b-91ae-364da2661108 git.kernel.org Patch
git.kernel.org/stable/c/44e62f5d35678686734afd47c6a421ad30772e7f af854a3a-2127-422b-91ae-364da2661108 git.kernel.org Patch
git.kernel.org/stable/c/93f0133b9d589cc6e865f254ad9be3e9d8133f50 af854a3a-2127-422b-91ae-364da2661108 git.kernel.org Patch
git.kernel.org/stable/c/c1ae4d1e76eacddaacb958b67cd942082f800c87 af854a3a-2127-422b-91ae-364da2661108 git.kernel.org Patch
git.kernel.org/stable/c/e3e27d2b446deb1f643758a0c4731f5c22492810 af854a3a-2127-422b-91ae-364da2661108 git.kernel.org Patch
git.kernel.org/stable/c/2e43d8eba6edd1cf05a3a20fdd77688fa7ec16a4 af854a3a-2127-422b-91ae-364da2661108 git.kernel.org Patch
lists.debian.org/debian-lts-announce/2024/06/msg00020.html af854a3a-2127-422b-91ae-364da2661108 lists.debian.org Mailing List, Third Party Advisory
git.kernel.org/stable/c/899265c1389fe022802aae73dbf13ee08837a35a af854a3a-2127-422b-91ae-364da2661108 git.kernel.org Patch
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report