VYPR
← All advisories
High severity7.8NVD Advisory· Published May 1, 2024· Updated May 12, 2026

CVE-2024-27024

CVE-2024-27024

Description

In the Linux kernel, the following vulnerability has been resolved:

net/rds: fix WARNING in rds_conn_connect_if_down

If connection isn't established yet, get_mr() will fail, trigger connection after get_mr().

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

A WARNING in rds_conn_connect_if_down can be triggered when get_mr fails before a connection is established, potentially causing a denial of service.

Vulnerability

Overview

CVE-2024-27024 is a vulnerability in the Linux kernel's RDS (Reliable Datagram Sockets) implementation. The core issue is a missing check for an established connection before calling get_mr(). If the RDS connection is not yet established, get_mr() fails, and the subsequent call to rds_conn_connect_if_down() can trigger a WARNING, potentially leading to a denial of service [1][2][3][4].

Exploitation

Context

To exploit this vulnerability, a local attacker would need to successfully call get_mr() on an RDS socket before the connection setup completes. The attack surface is limited to systems where the RDS protocol is loaded and actively used. No authentication is explicitly required beyond local access to create RDS sockets; however, the attacker must be able to influence the connection state of an RDS socket [1].

Impact

Successful exploitation triggers a kernel WARNING, which may cause a system crash or instability, resulting in a denial of service. The CVSS v3 score of 7.8 (High) reflects the relatively low complexity and the potential for significant availability impact [1].

Mitigation

Patches have been applied to the Linux kernel stable branches, as indicated by the referenced commits [2][3][4]. Users should update to a kernel version containing the fix. Affected Siemens products, such as the SIMATIC S7-1500 TM MFP - GNU/Linux subsystem, are listed in Siemens advisory SSA-265688 as affected by this and many other CVEs, and users should apply the appropriate firmware updates [1].

References
  1. SSA-265688
  2. Making sure you're not a bot!
  3. Making sure you're not a bot!
  4. Making sure you're not a bot!

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

102

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

11

News mentions

0

No linked articles in our index yet.