CVE-2024-38591: Linux vulnerability

CVE-2024-38591: RDMA/hns: Fix deadlock on SRQ async events.

In the Linux kernel, the following vulnerability has been resolved: RDMA/hns: Fix deadlock on SRQ async events. xa_lock for SRQ table may be required in AEQ. Use xa_store_irq()/ xa_erase_irq() to avoid deadlock.

UnknownCVSS not scoredNot KEV-listedUpdatedMay 11, 2026, 20:19 UTC (UTC+00:00)

Security readout for executives and security teams

Plain-English summary

This is a Linux kernel availability issue in the RDMA/hns driver. A deadlock can occur during shared receive queue async events. The sources do not provide CVSS, confirmed exploitation, or business-impact detail, so urgency depends on whether affected Linux hosts use this RDMA driver path.

Executive priority

Treat as targeted infrastructure maintenance, not a broad emergency, unless RDMA/hns is used on critical production servers. Patch exposed systems through normal kernel maintenance windows, with higher priority for availability-sensitive environments.

Technical view

The flaw involves SRQ table locking in RDMA/hns async event handling. The kernel fix changes SRQ table operations to use xa_store_irq() and xa_erase_irq(), avoiding a deadlock when xa_lock may be needed in AEQ context.

Likely exposure

Exposure appears narrow: affected Linux kernel versions using the RDMA/hns driver and SRQ async event handling. General systems not using this RDMA path are less likely exposed. Distribution-specific package status is not fully established in the bundle.

Exploitation context

The provided sources do not show active exploitation, public exploit activity, or CISA KEV listing. The issue is described as a kernel deadlock, suggesting availability impact rather than direct data compromise based on available evidence.

Researcher notes

Evidence is limited to the CVE record, Linux stable commit references, and a Debian LTS announcement. No CVSS, CWE, exploitability analysis, or detailed affected distribution matrix is included in the supplied bundle.

Mitigation direction

Inventory Linux systems using RDMA/hns or related RDMA hardware support.
Apply kernel updates containing the referenced stable fixes.
Check distribution advisories for packaged kernel backports.
Prioritize RDMA-enabled servers where availability is business-critical.

Validation and detection

Confirm running kernel versions against vendor fixed packages.
Check whether RDMA/hns modules or hardware are present.
Review kernel update changelogs for CVE-2024-38591 or referenced commits.
Validate patched hosts after reboot into the updated kernel.

Prepared: May 22, 2026, 04:37 UTC (UTC+00:00)
Confidence: medium
Sources: 10

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2024-38591 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup

Vulnerability profileCVE Program record

Severity: Unknown
CVSS: Not scored
Known Exploited: No
Published: Jun 19, 2024, 13:45 UTC (UTC+00:00)

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors

3Timeline events

2ADP providers

9Source links

SSVC decision data

Timestamp: Jun 20, 2024, 19:45 UTC (UTC+00:00)
Version: 2.0.3

Exploitation: noneAutomatable: noTechnical Impact: partial

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
Jun 18, 2024, 19:36 UTC (UTC+00:00)
CVE publishedCVE Program
The CVE record was published.
Jun 19, 2024, 13:45 UTC (UTC+00:00)
CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
May 11, 2026, 20:19 UTC (UTC+00:00)

ADP provider summaries

other:ssvc

Source materials

CVE List V5 sourceCVE List V5
https://git.kernel.org/stable/c/605889754ee68aacf7c381938fcd5eb654e71822CVE reference, Linux
https://git.kernel.org/stable/c/4a3be1a0ffe04c085dd7f79be97c91b0c786df3dCVE reference, Linux
https://git.kernel.org/stable/c/756ddbe665ea7f9416951bd76731b174d136eea0CVE reference, Linux
https://git.kernel.org/stable/c/22c915af31bd84ffaa46145e317f53333f94a868CVE reference, Linux
https://git.kernel.org/stable/c/72dc542f0d8977e7d41d610db6bb65c47cad43e9CVE reference, Linux
https://git.kernel.org/stable/c/d271e66abac5c7eb8de345b9b44d89f777437a4cCVE reference, Linux
https://git.kernel.org/stable/c/b46494b6f9c19f141114a57729e198698f40af37CVE reference, Linux
https://lists.debian.org/debian-lts-announce/2025/03/msg00002.htmlCVE reference, CVE

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus

LinuxLinux81fce6291d9999cee692e4118134a8c850b60857, 81fce6291d9999cee692e4118134a8c850b60857, 81fce6291d9999cee692e4118134a8c850b60857, 81fce6291d9999cee692e4118134a8c850b60857, 81fce6291d9999cee692e4118134a8c850b60857, 81fce6291d9999cee692e4118134a8c850b60857, 81fce6291d9999cee692e4118134a8c850b60857unaffected

LinuxLinux5.0, 0, 5.10.234, 5.15.161, 6.1.93, 6.6.33, 6.8.12, 6.9.3, 6.10affected

Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.