LiveActive security incident?Get immediate response
CVE Record

CVE-2024-35998: smb3: fix lock ordering potential deadlock in cifs_sync_mid_result

In the Linux kernel, the following vulnerability has been resolved: smb3: fix lock ordering potential deadlock in cifs_sync_mid_result Coverity spotted that the cifs_sync_mid_result function could deadlock "Thread deadlock (ORDER_REVERSAL) lock_order: Calling spin_lock acquires lock TCP_Server_Info.srv_lock while holding lock TCP_Server_Info.mid_lock" Addresses-Coverity: 1590401 ("Thread deadlock (ORDER_REVERSAL)")

HighCVSS 7.5Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

A Linux SMB3/CIFS networking flaw can cause the kernel to deadlock because two internal locks may be acquired in the wrong order. A successful trigger could make file-sharing operations or the affected system unavailable. The supplied CVSS score is 7.5, reflecting availability impact without identified confidentiality or integrity loss.

Executive priority

Treat this as a high-priority availability issue for systems dependent on Linux SMB file sharing. Expedite vendor-kernel updates on exposed or business-critical hosts, while recognizing that the bundle does not establish active exploitation. Lower priority may be reasonable for systems where SMB3/CIFS is absent or unused, after validation.

Technical view

Coverity identified an order reversal in cifs_sync_mid_result: TCP_Server_Info.srv_lock may be acquired while TCP_Server_Info.mid_lock is held. Competing execution paths could therefore deadlock. The issue affects Linux kernel SMB3/CIFS processing and is resolved by the referenced stable-kernel changes.

Likely exposure

Potential exposure exists on Linux systems running affected kernel code and using SMB3/CIFS functionality. Actual status depends on the exact kernel build and distribution backports. The supplied version data mixes release numbers and commit identifiers, so version-string comparison alone is insufficient.

Exploitation context

The CVSS vector describes a network-reachable, low-complexity, unauthenticated availability risk. However, the supplied sources provide no evidence of active exploitation, and the CVE is not listed as KEV in the bundle. Practical triggering conditions and exploit reliability are not documented here.

Researcher notes

The finding originates from a Coverity ORDER_REVERSAL report rather than a documented in-the-wild incident. No CWE is supplied. Researchers should map the referenced changes across kernel branches and distribution backports, then assess whether relevant concurrent paths are reachable. The source bundle does not provide trigger details, crash signatures, or exploitation telemetry.

Mitigation direction

  • Install a vendor-supported kernel containing the applicable upstream stable fix.
  • Check distribution security guidance for backported fixes before relying on kernel version numbers.
  • Prioritize systems that actively use SMB3/CIFS and support availability-sensitive workloads.
  • If immediate patching is impossible, reduce unnecessary SMB3/CIFS exposure following vendor guidance.

Validation and detection

  • Inventory kernel package versions and identify systems using SMB3/CIFS functionality.
  • Confirm the vendor kernel includes an applicable referenced stable-kernel change or documented backport.
  • Review vendor advisories because the supplied affected-version representation is ambiguous.
  • After updating, verify the intended kernel is running and SMB file-sharing workloads remain stable.
Prepared
Confidence
medium
Sources
6

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2024-35998 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.5 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
2ADP providers
5Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.5CVSS 3.1HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H3.93.6Linux

Vulnerability scoring details

Base CVSS 3.1 score

7.5High
CVSS 3.1 vector shape for CVE-2024-35998Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
other:ssvc
CVECVE Program Container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux64d62ac6d6514cba1305bd08e271ec1843bdd612, 90c49fce1c43e1cc152695e20363ff5087897c09, 90c49fce1c43e1cc152695e20363ff5087897c09, 90c49fce1c43e1cc152695e20363ff5087897c09, c511954bf142fe1995aec3c739a9f1a76990283a, 0b08c4c499200be67d54c439d56e5ea866869945, 6.1.28, 6.2.15, 6.3.2unaffected
LinuxLinux6.4, 0, 6.1.90, 6.6.30, 6.8.9, 6.9affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.