PT-2024-26835 · Linux+6 · Linux Kernel+6

Published 2024-04-25 · Updated 2026-05-26 · CVE-2024-35999

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.6.37

Description A missing lock when picking a channel in the smb3 module of the Linux kernel has been identified. This issue was spotted by Coverity, which reported a data race condition due to the missing lock. The problem occurs when accessing the ses channel index without holding the channel lock.

Recommendations Update to Linux kernel version 6.6.37 or later to resolve the issue. As a temporary workaround, consider restricting access to the smb3 module until a patch is available.

Exploit

Fix

DoS

Improper Locking

Weakness Enumeration

CWE-667

Related Identifiers

AZL-59474

BDU:2025-03062

CVE-2024-35999

MGASA-2024-0263

MGASA-2024-0266

SUSE-SU-2024:2008-1

SUSE-SU-2024:2019-1

SUSE-SU-2024:2135-1

SUSE-SU-2024:2190-1

SUSE-SU-2024:2203-1

SUSE-SU-2024:2973-1

SUSE-SU-2025:20008-1

SUSE-SU-2025:20028-1

USN-6949-1

USN-6949-2

USN-6952-1

USN-6952-2

USN-6955-1

Affected Products

Astra Linux

Debian

Linuxmint

Linux Kernel

Red Os

Suse

Ubuntu

References · 2761

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/35xxx/CVE-2024-35999.json · Exploit
• https://ubuntu.com/security/CVE-2024-38541 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-OS-DEBIAN-11-CVE-2024-35999 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-36943 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-38598 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-36003 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-36962 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-6955-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-36000 · Vendor Advisory
• https://git.kernel.org/stable/c/8094a600245e9b28eb36a13036f202ad67c1f887 · Patch
• https://ubuntu.com/security/CVE-2024-36952 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-38590 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-36892 · Vendor Advisory
• https://osv.dev/vulnerability/USN-6949-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-36001 · Vendor Advisory