VYPR
← All advisories
Medium severity5.8NVD Advisory· Published May 19, 2024· Updated May 12, 2026

CVE-2024-35910

CVE-2024-35910

Description

In the Linux kernel, the following vulnerability has been resolved:

tcp: properly terminate timers for kernel sockets

We had various syzbot reports about tcp timers firing after the corresponding netns has been dismantled.

Fortunately Josef Bacik could trigger the issue more often, and could test a patch I wrote two years ago.

When TCP sockets are closed, we call inet_csk_clear_xmit_timers() to 'stop' the timers.

inet_csk_clear_xmit_timers() can be called from any context, including when socket lock is held. This is the reason it uses sk_stop_timer(), aka del_timer(). This means that ongoing timers might finish much later.

For user sockets, this is fine because each running timer holds a reference on the socket, and the user socket holds a reference on the netns.

For kernel sockets, we risk that the netns is freed before timer can complete, because kernel sockets do not hold reference on the netns.

This patch adds inet_csk_clear_xmit_timers_sync() function that using sk_stop_timer_sync() to make sure all timers are terminated before the kernel socket is released. Modules using kernel sockets close them in their netns exit() handler.

Also add sock_not_owned_by_me() helper to get LOCKDEP support : inet_csk_clear_xmit_timers_sync() must not be called while socket lock is held.

It is very possible we can revert in the future commit 3a58f13a881e ("net: rds: acquire refcount on TCP sockets") which attempted to solve the issue in rds only. (net/smc/af_smc.c and net/mptcp/subflow.c have similar code)

We probably can remove the check_net() tests from tcp_out_of_resources() and __tcp_close() in the future.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

In the Linux kernel, TCP timers on kernel sockets are not properly terminated before netns dismantle, potentially causing use-after-free.

Vulnerability

Details

CVE-2024-35910 is a medium-severity flaw in the Linux kernel's TCP timer management for kernel sockets. The root cause is that inet_csk_clear_xmit_timers() uses del_timer() instead of del_timer_sync(), which does not guarantee that running timers have completed before the function returns. For user sockets, this is safe because both the socket and the netns hold references, but kernel sockets do not hold a netns reference, so timers may fire after the netns has been freed, leading to a use-after-free condition [1].

Exploitation

The vulnerability can be triggered by any process that can cause a kernel socket to be closed and its associated network namespace to be dismantled. Affected subsystems include RDS, SMC, and MPTCP, which use kernel sockets. An attacker with sufficient privileges (e.g., ability to create and close kernel sockets or trigger netns exit) could cause the race condition. No authentication is required if the attacker already has local access.

Impact

A successful exploit could allow an attacker to cause a use-after-free, potentially leading to kernel memory corruption, denial of service (system crash), or arbitrary code execution. The CVSS v3.1 base score is 5.8 (Medium), indicating significant potential for impact.

Mitigation

The fix was introduced in the Linux kernel stable tree via commits [3] and [4], which add inet_csk_clear_xmit_timers_sync() to ensure all timers are synchronously stopped before releasing kernel sockets. Users should update to a patched kernel version. Siemens has also listed this CVE in their advisory SSA-265688 [1], indicating affected products like SIMATIC S7-1500 TM MFP.

References
  1. SSA-265688
  2. Making sure you're not a bot!
  3. Making sure you're not a bot!

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

87

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

12

News mentions

0

No linked articles in our index yet.