CVE-2024-35910tcp: properly terminate timers for kernel sockets
Updated under an hour ago ()
Does this affect you?
It affects Linux and 6 other products. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: tcp: properly terminate timers for kernel sockets We had various syzbot reports about tcp timers firing after the corresponding netns has been dismantled. Fortunately Josef Bacik could trigger the issue more often, and could test a patch I wrote two years ago. When TCP sockets are closed, we call inet_csk_clear_xmit_timers() to 'stop' the timers. inet_csk_clear_xmit_timers() can be called from any context, including when socket lock is held. This is the reason it uses sk_stop_timer(), aka del_timer(). This means that ongoing timers might finish much later. For user sockets, this is fine because each running timer holds a reference on the socket, and the user socket holds a reference on the netns. For kernel sockets, we risk that the netns is freed before timer can complete, because kernel sockets do not hold reference on the netns. This patch adds inet_csk_clear_xmit_timers_sync() function that using sk_stop_timer_sync() to make sure all timers are terminated before the kernel socket is released. Modules using kernel sockets close them in their netns exit() handler. Also add sock_not_owned_by_me() helper to get LOCKDEP support : inet_csk_clear_xmit_timers_sync() must not be called while socket lock is held. It is very possible we can revert in the future commit 3a58f13a881e ("net: rds: acquire refcount on TCP sockets") which attempted to solve the issue in rds only. (net/smc/af_smc.c and net/mptcp/subflow.c have similar code) We probably can remove the check_net() tests from tcp_out_of_resources() and __tcp_close() in the future.
- CVSS
- 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Modified
- Record last updated
- Oct 15, 2026
- First seen by InfoSec Signals
- Oct 15, 2026
Affected products
Linux Linux linux:linux (from the name) | from 26abe14379f8e2fa3fd1bcf97c9a7ad9364886fe before 93f0133b9d589cc6e865f254ad9be3e9d8133f50; from 26abe14379f8e2fa3fd1bcf97c9a7ad9364886fe before 44e62f5d35678686734afd47c6a421ad30772e7f; from 26abe14379f8e2fa3fd1bcf97c9a7ad9364886fe before e3e27d2b446deb1f643758a0c4731f5c22492810; 26abe14379f8e2fa3fd1bcf97c9a7ad9364886fe builds before 2e43d8eba6edd1cf05a3a20fdd77688fa7ec16a4; from 26abe14379f8e2fa3fd1bcf97c9a7ad9364886fe before 91b243de910a9ac8476d40238ab3dbfeedd5b7de; from 26abe14379f8e2fa3fd1bcf97c9a7ad9364886fe before c1ae4d1e76eacddaacb958b67cd942082f800c87; from 26abe14379f8e2fa3fd1bcf97c9a7ad9364886fe before 899265c1389fe022802aae73dbf13ee08837a35a; from 26abe14379f8e2fa3fd1bcf97c9a7ad9364886fe before 151c9c724d05d5b0dd8acd3e11cb69ef1f2dbada | CNA record |
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518_4_pn_dp_mfp (from the name) | from V3.1.0 before V3.1.5 | CISA ADP |
Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518f_4_pn_dp_mfp (from the name) | from V3.1.0 before V3.1.5 | CISA ADP |
Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem siemens:simatic_s7_1500_tm_mfp_gnu_linux_subsystem (from the name) | before V1.1.1 | CISA ADP |
Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP siemens:siplus_s7_1500_cpu_1518_4_pn_dp_mfp (from the name) | from V3.1.0 before V3.1.5 | CISA ADP |
linux linux_kernel linux:linux_kernel | from 4.2 before 4.19.312; from 4.20 before 5.4.274; from 5.5 before 5.10.215; from 5.11 before 5.15.154; from 5.16 before 6.1.85; from 6.2 before 6.6.26; from 6.7 before 6.8.5; 6.9 | NVD |
debian debian_linux debian:debian_linux | 10.0 | NVD |
References
- https://git.kernel.org/stable/c/93f0133b9d589cc6e865f254ad9be3e9d8133f50patch
- https://git.kernel.org/stable/c/44e62f5d35678686734afd47c6a421ad30772e7fpatch
- https://git.kernel.org/stable/c/e3e27d2b446deb1f643758a0c4731f5c22492810patch
- https://git.kernel.org/stable/c/2e43d8eba6edd1cf05a3a20fdd77688fa7ec16a4patch
- https://git.kernel.org/stable/c/91b243de910a9ac8476d40238ab3dbfeedd5b7depatch
- https://git.kernel.org/stable/c/c1ae4d1e76eacddaacb958b67cd942082f800c87patch
- https://git.kernel.org/stable/c/899265c1389fe022802aae73dbf13ee08837a35apatch
- https://git.kernel.org/stable/c/151c9c724d05d5b0dd8acd3e11cb69ef1f2dbadapatch
- https://lists.debian.org/debian-lts-announce/2024/06/msg00017.htmlmailing-list, third-party-advisory
- https://lists.debian.org/debian-lts-announce/2024/06/msg00020.htmlmailing-list, third-party-advisory
- https://cert-portal.siemens.com/productcert/html/ssa-265688.html
- https://cert-portal.siemens.com/productcert/html/ssa-398330.html
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.