CVE-2024-36945 – This CVE describes a memory leak vulnerability ... (How to Fix)

Q: What is the severity of CVE-2024-36945?

CVE-2024-36945 has a CVSS score of 5.5 (MEDIUM). This CVE describes a memory leak vulnerability in the Linux kernel's SMC (Shared Memory Communications) networking subsystem. When the smc_ib_find_route() function fails to properly release neighbor and routing table resources, it can cause gradual memory exhaustion. This affects Linux systems using SMC networking features.

📋 TL;DR

This CVE describes a memory leak vulnerability in the Linux kernel's SMC (Shared Memory Communications) networking subsystem. When the smc_ib_find_route() function fails to properly release neighbor and routing table resources, it can cause gradual memory exhaustion. This affects Linux systems using SMC networking features.

💻 Affected Systems

Products:

Linux kernel

Versions: Linux kernel versions with SMC support, specifically affected versions before the fix commits listed in references

Operating Systems: Linux distributions using affected kernel versions

Default Config Vulnerable: ✅ No

Notes: Only vulnerable if SMC (Shared Memory Communications) networking is enabled and used. Many systems don't use SMC by default.

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Sustained exploitation could lead to kernel memory exhaustion, causing system instability, denial of service, or potential kernel crashes.

🟠

Likely Case

Gradual memory consumption over time leading to performance degradation and potential service disruption in systems using SMC networking.

🟢

If Mitigated

Minimal impact with proper monitoring and memory limits in place, though resource exhaustion could still occur under heavy SMC usage.

🌐 Internet-Facing: LOW - SMC is typically used for internal high-performance computing and database communications, not directly internet-facing services.

🏢 Internal Only: MEDIUM - Systems using SMC for internal cluster communications could experience performance issues or service disruption.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: NO

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Exploitation requires ability to trigger SMC route lookups repeatedly. This is a resource exhaustion vulnerability, not a code execution vulnerability.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Fixed in kernel commits: 2ddc0dd7fec86ee53b8928a5cca5fbddd4fc7c06, 5df93c029a907b0ff5a4eeadd77ba06ff0a277d2, d5a466ab6e78d6f2e0f64435f1e17246c8e941ff, da91e447d06dc649fcf46e59122e7bf8f0b2e0db

Vendor Advisory: https://git.kernel.org/stable/c/2ddc0dd7fec86ee53b8928a5cca5fbddd4fc7c06

Restart Required: Yes

Instructions:

1. Update to a kernel version containing the fix commits. 2. Check your distribution's security advisories for backported patches. 3. Reboot the system after kernel update.

🔧 Temporary Workarounds

Disable SMC networking

linux

If SMC is not required, disable it to eliminate the vulnerability surface

modprobe -r smc
echo 'blacklist smc' >> /etc/modprobe.d/blacklist.conf

🧯 If You Can't Patch

Monitor kernel memory usage and system performance metrics for signs of memory exhaustion
Implement memory limits and restart services if memory consumption exceeds thresholds

🔍 How to Verify

Check if Vulnerable:

Check if SMC module is loaded: lsmod | grep smc. If loaded and kernel version is before fix commits, system may be vulnerable.

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version includes fix commits or check with distribution's security update verification tools.

📡 Detection & Monitoring

Log Indicators:

Kernel OOM (Out of Memory) messages
Increasing memory usage in kernel space
System performance degradation logs

Network Indicators:

Unusual SMC connection patterns if monitored

SIEM Query:

source="kernel" AND ("Out of memory" OR "kernel: Out of memory" OR "oom-killer")

📊 Metadata

CVE ID: CVE-2024-36945

CVSS v3 Score: 5.5 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE: CWE-401

Published: May 30, 2024

Last Updated: September 17, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2024-36945, you might also want to check these: