PT-2024-35609 · Linux+7 · Linux Kernel+7
Published
2024-12-02
·
Updated
2026-01-29
·
CVE-2024-53164
CVSS v3.1
5.5
Medium
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel versions prior to 6.6.74
Description
The issue concerns the Linux kernel's network scheduling subsystem, specifically the
qdisc tree reduce backlog() function. Changes to sch->q.qlen around this function need to occur before the function call to ensure proper notification of parent qdiscs when a child qdisc is about to become empty. Failure to do so may result in notification failures.Recommendations
For versions prior to 6.6.74, update to version 6.6.74 or later to resolve the issue. As a temporary workaround, consider modifying the code to ensure that changes to
sch->q.qlen happen before calling qdisc tree reduce backlog(). Restrict access to the vulnerable network scheduling subsystem to minimize the risk of exploitation until the update can be applied.Exploit
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Astra Linux
Debian
Linuxmint
Linux Kernel
Red Hat
Red Os
Suse
Ubuntu