Security readout for executives and security teams
Plain-English summary
A Linux kernel UDP race can expose a newly bound socket before it receives the flag required for safe lockless access. A local, low-privileged user may trigger the condition without user interaction. The supplied CVSS score is 7.8, reflecting potentially serious confidentiality, integrity, and availability impact.
Executive priority
Treat as a high-priority kernel maintenance issue, especially where untrusted users or workloads can execute locally. It is not supported as an emergency internet-wide threat because the attack vector is local and no active exploitation is documented. Patch through normal expedited change controls.
Technical view
In UDP early-demultiplexing and socket lookup, code accesses a socket without taking a reference and relies on RCU protection. SOCK_RCU_FREE was set after the socket entered the hash table, creating a small race where another CPU could retrieve it before safe RCU handling was declared. The fix sets the flag before insertion.
Likely exposure
Systems running affected Linux kernel versions are potentially exposed, particularly multi-user hosts or workloads permitting untrusted local code. The source lists affected kernel lines through versions including 5.4.280, 5.10.222, 5.15.163, 6.1.100, 6.6.41, 6.9.10, and 6.10. Distribution backports may change actual status.
Exploitation context
The CVSS vector requires local access and low privileges, with low attack complexity and no user interaction. Syzkaller triggered a kernel warning demonstrating the race. The source bundle provides no evidence of practical exploitation or active attacks, and the CVE is not listed as KEV.
Researcher notes
The defect is a narrow ordering race in udp_lib_get_port(): hash-table publication occurred before SOCK_RCU_FREE was set. Readers in udp_v4/v6_early_demux and sk_lookup can access the socket without refcounting. The supplied evidence demonstrates a warning under syzkaller; it does not establish a reliable exploit or document exploitation in the wild.
Mitigation direction
- Update to a vendor-supported kernel containing the applicable referenced stable fix.
- Review distribution security advisories because vendors may backport fixes without changing the upstream-style version.
- Restrict untrusted local code execution until affected systems are patched.
- Prioritize shared, multi-user, container-hosting, and externally managed compute systems.
Validation and detection
- Inventory running kernel versions across physical hosts, virtual machines, appliances, and container hosts.
- Check vendor changelogs for CVE-2024-41041 or the applicable referenced stable commit.
- Confirm the patched kernel is running after maintenance, not merely installed.
- Use controlled regression testing to verify UDP networking remains stable after updating.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2024-41041 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/7a67c4e47626e6daccda62888f8b096abb5d3940CVE reference, Linux
- https://git.kernel.org/stable/c/9f965684c57c3117cfd2f754dd3270383c529fbaCVE reference, Linux
- https://git.kernel.org/stable/c/ddf516e50bf8a7bc9b3bd8a9831f9c7a8131a32aCVE reference, Linux
- https://git.kernel.org/stable/c/a6db0d3ea6536e7120871e5448b3032570152ec6CVE reference, Linux
- https://git.kernel.org/stable/c/c5fd77ca13d657c6e99bf04f0917445e6a80231eCVE reference, Linux
- https://git.kernel.org/stable/c/20ceae10623c3b29fdf7609690849475bcdebdb0CVE reference, Linux
- https://git.kernel.org/stable/c/5c0b485a8c6116516f33925b9ce5b6104a6eadfdCVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/01/msg00001.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.