VYPR
← All advisories
Unrated severityNVD Advisory· Published Jul 12, 2024· Updated Nov 3, 2025

tipc: force a dst refcount before doing decryption

CVE-2024-40983

Description

In the Linux kernel, the following vulnerability has been resolved:

tipc: force a dst refcount before doing decryption

As it says in commit 3bc07321ccc2 ("xfrm: Force a dst refcount before entering the xfrm type handlers"):

"Crypto requests might return asynchronous. In this case we leave the rcu protected region, so force a refcount on the skb's destination entry before we enter the xfrm type input/output handlers."

On TIPC decryption path it has the same problem, and skb_dst_force() should be called before doing decryption to avoid a possible crash.

Shuang reported this issue when this warning is triggered:

[] WARNING: include/net/dst.h:337 tipc_sk_rcv+0x1055/0x1ea0 [tipc] [] Kdump: loaded Tainted: G W --------- - - 4.18.0-496.el8.x86_64+debug [] Workqueue: crypto cryptd_queue_worker [] RIP: 0010:tipc_sk_rcv+0x1055/0x1ea0 [tipc] [] Call Trace: [] tipc_sk_mcast_rcv+0x548/0xea0 [tipc] [] tipc_rcv+0xcf5/0x1060 [tipc] [] tipc_aead_decrypt_done+0x215/0x2e0 [tipc] [] cryptd_aead_crypt+0xdb/0x190 [] cryptd_queue_worker+0xed/0x190 [] process_one_work+0x93d/0x17e0

Affected products

152

Patches

6
6808b4137167
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.gitvia osv
commit
2ebe8f840c74
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.gitvia osv
commit
b57a4a2dc874
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.gitvia osv
commit
623c90d86a61
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.gitvia osv
commit
692803b39a36
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.gitvia osv
commit
3eb1b3962789
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.gitvia osv
commit

Vulnerability mechanics

Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

6

News mentions

0

No linked articles in our index yet.