CVE-2024-36904

7.8 HIGH

Denial of Service

📋 TL;DR

A race condition vulnerability in the Linux kernel's TCP implementation allows a use-after-free condition when reusing TIME-WAIT sockets. This can lead to kernel memory corruption and potential privilege escalation. All Linux systems using affected kernel versions are vulnerable.

💻 Affected Systems

Products:

Linux kernel

Versions: Kernel versions from commit ec94c2696f0b (v5.14-rc1) to patches listed in references

Operating Systems: All Linux distributions using affected kernel versions

Default Config Vulnerable: ⚠️ Yes

Notes: Only affects systems with TCP networking enabled

📦 What is this software?

Debian Linux by Debian

View all CVEs affecting Debian Linux →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Kernel panic, system crash, or privilege escalation leading to full system compromise

🟠

Likely Case

System instability, crashes, or denial of service

🟢

If Mitigated

Minor performance impact from port reuse failures, no security impact

🌐 Internet-Facing: MEDIUM - Requires network access and ability to create TCP connections

🏢 Internal Only: MEDIUM - Requires local network access and ability to create TCP connections

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ⚠️ Yes

Complexity: HIGH - Requires precise timing and race condition triggering

Exploitation requires network access and ability to create multiple TCP connections with specific timing

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Patches available in stable kernel trees: 13ed7cdf079686ccd3618335205700c03f6fb446 and others listed in references

Vendor Advisory: https://git.kernel.org/stable/c/13ed7cdf079686ccd3618335205700c03f6fb446

Restart Required: Yes

Instructions:

1. Update to patched kernel version from your distribution vendor
2. Reboot system to load new kernel
3. Verify kernel version after reboot

🔧 Temporary Workarounds

Disable TIME-WAIT socket reuse

linux

Prevents the vulnerable code path by disabling TIME-WAIT socket reuse

sysctl -w net.ipv4.tcp_tw_reuse=0

Increase TIME-WAIT timeout

linux

Reduces race condition window by increasing TIME-WAIT socket timeout

sysctl -w net.ipv4.tcp_fin_timeout=60

🧯 If You Can't Patch

Apply sysctl workarounds to disable vulnerable functionality
Restrict network access to vulnerable systems, especially from untrusted networks

🔍 How to Verify

Check if Vulnerable:

Check kernel version: uname -r and compare with affected versions (5.14-rc1 to patched versions)

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version after update and check that tcp_tw_reuse is disabled if using workaround

📡 Detection & Monitoring

Log Indicators:

Kernel panic logs
refcount warnings in kernel logs
TCP connection failures

Network Indicators:

Unusual TCP connection patterns
Multiple connection attempts to same port

SIEM Query:

source="kernel" AND ("refcount_warn_saturate" OR "use-after-free" OR "TIME-WAIT")

📊 Metadata

CVE ID: CVE-2024-36904

CVSS v3 Score: 7.8 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-416

Published: May 30, 2024

Last Updated: January 22, 2026

📋 TL;DR

💻 Affected Systems

📦 What is this software?

Debian Linux by Debian

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

⚠️ Risk & Real-World Impact

Worst Case

Likely Case

If Mitigated

🎯 Exploit Status

🛠️ Fix & Mitigation

✅ Official Fix

Instructions:

🔧 Temporary Workarounds

Disable TIME-WAIT socket reuse

Increase TIME-WAIT timeout

🧯 If You Can't Patch

🔍 How to Verify

Check if Vulnerable:

Check Version:

Verify Fix Applied:

📡 Detection & Monitoring

Log Indicators:

Network Indicators:

SIEM Query:

📊 Metadata

🔗 References

📤 Share & Export

🔗 Related Vulnerabilities