Security readout for executives and security teams
Plain-English summary
A Linux TCP flaw can cause a system to transmit packets excessively after an application-defined connection timeout has expired. A remote peer that reduces its receive window to zero can trigger the condition, potentially consuming network and processing resources and disrupting availability. The supplied severity is CVSS 7.5 High.
Executive priority
Treat this as a high-priority availability issue, especially for exposed, connection-heavy Linux services. Patch through normal expedited kernel maintenance after confirming vendor applicability. Emergency isolation is not justified by the supplied evidence alone because active exploitation is unconfirmed and exposure depends on TCP_USER_TIMEOUT usage.
Technical view
When TCP_USER_TIMEOUT is configured and the peer advertises a zero window, tcp_retransmit_timer() may retransmit approximately every two jiffies for about four minutes beyond the timeout. The correction makes tcp_rtx_probe0_timed_out() account for icsk_user_timeout. The reported impact is availability loss; confidentiality and integrity impacts are not identified.
Likely exposure
Exposure is limited to affected Linux kernels and TCP sockets configured with TCP_USER_TIMEOUT. Practical risk is greater where untrusted remote peers can maintain TCP connections and advertise a zero receive window. The supplied affected-version data includes several kernel lines, but precise distribution-specific package boundaries require vendor confirmation.
Exploitation context
The issue is remotely triggerable with low stated complexity and requires neither privileges nor user interaction according to the supplied CVSS vector. However, it is not in KEV, and the provided sources contain no evidence of active exploitation. Public proof-of-concept availability is not established by this bundle.
Researcher notes
The vulnerable behavior is a rapid probe retransmission loop continuing beyond the configured user timeout when the peer's send window is zero. Upstream supplied separate stable-tree corrections. The bundle does not establish resource-consumption measurements, confirmed denial-of-service cases, exploit availability, or exact package-level boundaries for every distribution.
Mitigation direction
- Install a vendor-supported kernel update containing the applicable upstream stable fix.
- Consult the Linux distribution advisory to identify the corrected package for each deployed kernel.
- Prioritize externally reachable systems that use TCP_USER_TIMEOUT with untrusted peers.
- Apply normal network resource monitoring while updates are being scheduled.
Validation and detection
- Inventory running kernel and distribution package versions across Linux systems.
- Compare each package against current distribution advisories and applicable stable fix commits.
- Identify applications or services that configure TCP_USER_TIMEOUT.
- After updating, verify the running kernel changed and the vendor marks the CVE resolved.
- Monitor for abnormal TCP retransmission volume and sustained zero-window connections.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2024-41007 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H3.93.6LinuxVulnerability scoring details
Base CVSS 3.1 score
7.5HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/7bb7670f92bfbd05fc41a8f9a8f358b7ffed65f4CVE reference, Linux
- https://git.kernel.org/stable/c/d2346fca5bed130dc712f276ac63450201d52969CVE reference, Linux
- https://git.kernel.org/stable/c/5d7e64d70a11d988553a08239c810a658e841982CVE reference, Linux
- https://git.kernel.org/stable/c/04317a2471c2f637b4c49cbd0e9c0d04a519f570CVE reference, Linux
- https://git.kernel.org/stable/c/e113cddefa27bbf5a79f72387b8fbd432a61a466CVE reference, Linux
- https://git.kernel.org/stable/c/dfcdd7f89e401d2c6616be90c76c2fac3fa98fdeCVE reference, Linux
- https://git.kernel.org/stable/c/66cb64a1d2239cd0309f9b5038b05462570a5be1CVE reference, Linux
- https://git.kernel.org/stable/c/97a9063518f198ec0adb2ecb89789de342bb8283CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/01/msg00001.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.