Security readout for executives and security teams
Plain-English summary
A Linux kernel flaw allows low-privileged local code to trigger an invalid interaction between BPF socket operations and MPTCP subflows. It is not described as remotely reachable. Although scored 7.8 with potentially high impacts, the supplied evidence demonstrates a kernel warning rather than confirmed compromise.
Executive priority
Treat this as a high-priority local privilege-boundary issue, especially on shared or multi-tenant Linux infrastructure. Patch through supported vendor channels promptly. It does not warrant the same emergency response as an actively exploited, unauthenticated internet-facing vulnerability based on current evidence.
Technical view
BPF can access MPTCP-level protocol operations while operating within a TCP subflow scope. A receive low-water-mark operation can reach an invalid MPTCP path and produce a kernel warning. The referenced kernel changes detect this problematic call and prevent the action.
Likely exposure
Most relevant to Linux hosts running affected kernels where low-privileged local users or workloads can exercise applicable BPF socket operations with MPTCP. The supplied metadata names versions 6.7, 6.8.5, and 6.9, but precise affected ranges are ambiguous. Confirm distributor backports rather than relying only on version numbers.
Exploitation context
The CVSS vector describes a local, low-complexity attack requiring low privileges and no user interaction. The CVE is not listed as KEV, and the supplied sources do not report active exploitation or a public weaponized exploit. Practical confidentiality, integrity, and availability impact is not demonstrated in the bundle.
Researcher notes
The evidence shows a kernel warning path during a BPF socket-option operation on an MPTCP connection. It does not explain how the scored high confidentiality, integrity, and availability impacts are achieved, and no CWE is supplied. Treat exploitation mechanics and practical impact as unproven from this bundle; use the referenced commits for code-level validation.
Mitigation direction
- Update to a vendor-supported kernel containing the applicable referenced stable fix.
- Check Linux distributor guidance because security fixes may be backported without changing the apparent upstream version.
- Prioritize untrusted-user, shared-hosting, container, and multi-tenant systems until their patch status is confirmed.
- Review the NetApp advisory separately for applicability to managed NetApp products.
Validation and detection
- Inventory running kernel versions across Linux hosts and appliances.
- Verify package changelogs or vendor advisories explicitly resolve CVE-2024-35894 or include an applicable fix commit.
- Confirm the corrected kernel is running after update and any required restart.
- Identify unpatched systems permitting local workloads to use relevant BPF and MPTCP functionality.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2024-35894 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/ee3c845787b621cfe82c2e52c513024a9d7a78f5CVE reference, Linux
- https://git.kernel.org/stable/c/3ffb1ab698376f09cc33101c07c1be229389fe29CVE reference, Linux
- https://git.kernel.org/stable/c/fcf4692fa39e86a590c14a4af2de704e1d20a3b5CVE reference, Linux
- https://security.netapp.com/advisory/ntap-20250321-0002/CVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.