VYPR
← All advisories
Medium severity5.5NVD Advisory· Published Oct 21, 2024· Updated May 12, 2026

CVE-2024-47710

CVE-2024-47710

Description

In the Linux kernel, the following vulnerability has been resolved:

sock_map: Add a cond_resched() in sock_hash_free()

Several syzbot soft lockup reports all have in common sock_hash_free()

If a map with a large number of buckets is destroyed, we need to yield the cpu when needed.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

A missing cond_resched() in sock_hash_free() can cause soft lockups when destroying a large sockmap, leading to denial of service.

Vulnerability

Description

CVE-2024-47710 is a denial-of-service vulnerability in the Linux kernel's sock_map, specifically in the sock_hash_free() function. The issue arises because the function iterates over all buckets of a sockmap without yielding the CPU, which can cause soft lockups on systems with a large number of buckets. This was identified through syzbot reports of soft lockups during sockmap destruction. [1]

Exploitation

An attacker with local access and the ability to create and trigger the destruction of a sockmap with a high bucket count can cause a soft lockup in the kernel. No special privileges beyond the ability to create sockmaps are required. The attack surface is limited to the kernel's BPF infrastructure, but the prerequisite of a large bucket map makes it more likely in environments with many BPF programs. [2]

Impact

The primary impact is a denial of service (availability) via a soft lockup, which can cause the system to become unresponsive or trigger a watchdog reset. The CVSS v3.1 base score is 5.5 (Medium) with the vector AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, indicating no confidentiality or integrity impact. [1]

Mitigation

The fix was applied by adding a cond_resched() call within sock_hash_free() to yield the CPU during the bucket iteration. This ensures that other tasks can run and prevents soft lockups. The patch is available in stable kernel updates. Affected products, such as Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem, are listed as affected by this CVE. [1][2]

References
  1. SSA-265688
  2. SSA-355557

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

106

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

12

News mentions

0

No linked articles in our index yet.