CVE-2024-42246 – A Linux kernel vulnerability in the SUNRPC subs... (How to Fix)

Q: What is the severity of CVE-2024-42246?

CVE-2024-42246 has a CVSS score of 5.5 (MEDIUM). A Linux kernel vulnerability in the SUNRPC subsystem causes an infinite loop when a BPF program returns -EPERM during TCP connection setup. This can lead to system freezes and log flooding. Systems using SUNRPC with BPF programs on kernel_connect() are affected.

📋 TL;DR

A Linux kernel vulnerability in the SUNRPC subsystem causes an infinite loop when a BPF program returns -EPERM during TCP connection setup. This can lead to system freezes and log flooding. Systems using SUNRPC with BPF programs on kernel_connect() are affected.

💻 Affected Systems

Products:

Linux kernel

Versions: Specific affected versions not explicitly stated in CVE, but patches exist for multiple stable branches.

Operating Systems: Linux distributions using vulnerable kernel versions

Default Config Vulnerable: ✅ No

Notes: Requires SUNRPC usage with BPF programs that can return -EPERM on kernel_connect(). Not vulnerable in default configurations.

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Kernel freezes completely, requiring hard reboot and causing denial of service on affected systems.

🟠

Likely Case

System logs fill up rapidly, potentially causing performance degradation and denial of service through resource exhaustion.

🟢

If Mitigated

Minimal impact if BPF programs don't trigger -EPERM or SUNRPC isn't used.

🌐 Internet-Facing: LOW - Requires specific BPF program configuration and SUNRPC usage.

🏢 Internal Only: MEDIUM - Internal systems using SUNRPC with custom BPF programs could be affected.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: NO

Unauthenticated Exploit: ✅ No

Complexity: HIGH

Exploitation requires specific BPF program configuration and SUNRPC usage. More likely to be triggered accidentally than maliciously.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Multiple stable kernel versions with commits: 02ee1976edb21a96ce8e3fd4ef563f14cc16d041, 5d8254e012996cee1a0f9cc920531cb7e4d9a011, 626dfed5fa3bfb41e0dffd796032b555b69f9cde, 934247ea65bc5eca8bdb7f8c0ddc15cef992a5d6, bc790261218952635f846aaf90bcc0974f6f62c6

Vendor Advisory: https://git.kernel.org/stable/c/02ee1976edb21a96ce8e3fd4ef563f14cc16d041

Restart Required: Yes

Instructions:

1. Update Linux kernel to patched version from your distribution. 2. Reboot system to load new kernel. 3. Verify kernel version matches patched release.

🔧 Temporary Workarounds

Disable problematic BPF programs

linux

Remove or modify BPF programs that could return -EPERM on kernel_connect() calls

# Review and remove BPF programs using: bpftool prog list
# Or modify programs to avoid returning -EPERM

Monitor system logs

linux

Set up log rotation and monitoring to detect log flooding

# Configure logrotate: /etc/logrotate.conf
# Monitor syslog: tail -f /var/log/syslog

🧯 If You Can't Patch

Avoid using BPF programs that could return -EPERM on SUNRPC connections
Implement aggressive log rotation and monitoring for syslog flooding

🔍 How to Verify

Check if Vulnerable:

Check kernel version and if SUNRPC with BPF programs returning -EPERM is in use

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version includes the patch commits and test SUNRPC connections with BPF programs

📡 Detection & Monitoring

Log Indicators:

Rapid syslog filling with connection errors
Repeated EPERM errors in kernel logs

Network Indicators:

SUNRPC connection failures when BPF programs are active

SIEM Query:

source="kernel" AND "EPERM" AND "xs_tcp_setup_socket"

📊 Metadata

CVE ID: CVE-2024-42246

CVSS v3 Score: 5.5 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE: CWE-835

Published: August 7, 2024

Last Updated: November 3, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2024-42246, you might also want to check these: