LiveActive security incident?Get immediate response
CVE Record

CVE-2024-57903: net: restrict SO_REUSEPORT to inet sockets

In the Linux kernel, the following vulnerability has been resolved: net: restrict SO_REUSEPORT to inet sockets After blamed commit, crypto sockets could accidentally be destroyed from RCU call back, as spotted by zyzbot [1]. Trying to acquire a mutex in RCU callback is not allowed. Restrict SO_REUSEPORT socket option to inet sockets. v1 of this patch supported TCP, UDP and SCTP sockets, but fcnal-test.sh test needed RAW and ICMP support. [1] BUG: sleeping function called from invalid context at kernel/locking/mutex.c:562 in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 24, name: ksoftirqd/1 preempt_count: 100, expected: 0 RCU nest depth: 0, expected: 0 1 lock held by ksoftirqd/1/24: #0: ffffffff8e937ba0 (rcu_callback){....}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:337 [inline] #0: ffffffff8e937ba0 (rcu_callback){....}-{0:0}, at: rcu_do_batch kernel/rcu/tree.c:2561 [inline] #0: ffffffff8e937ba0 (rcu_callback){....}-{0:0}, at: rcu_core+0xa37/0x17a0 kernel/rcu/tree.c:2823 Preemption disabled at: [<ffffffff8161c8c8>] softirq_handle_begin kernel/softirq.c:402 [inline] [<ffffffff8161c8c8>] handle_softirqs+0x128/0x9b0 kernel/softirq.c:537 CPU: 1 UID: 0 PID: 24 Comm: ksoftirqd/1 Not tainted 6.13.0-rc3-syzkaller-00174-ga024e377efed #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 __might_resched+0x5d4/0x780 kernel/sched/core.c:8758 __mutex_lock_common kernel/locking/mutex.c:562 [inline] __mutex_lock+0x131/0xee0 kernel/locking/mutex.c:735 crypto_put_default_null_skcipher+0x18/0x70 crypto/crypto_null.c:179 aead_release+0x3d/0x50 crypto/algif_aead.c:489 alg_do_release crypto/af_alg.c:118 [inline] alg_sock_destruct+0x86/0xc0 crypto/af_alg.c:502 __sk_destruct+0x58/0x5f0 net/core/sock.c:2260 rcu_do_batch kernel/rcu/tree.c:2567 [inline] rcu_core+0xaaa/0x17a0 kernel/rcu/tree.c:2823 handle_softirqs+0x2d4/0x9b0 kernel/softirq.c:561 run_ksoftirqd+0xca/0x130 kernel/softirq.c:950 smpboot_thread_fn+0x544/0xa30 kernel/smpboot.c:164 kthread+0x2f0/0x390 kernel/kthread.c:389 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 </TASK>

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

CVE-2024-57903 is a Linux kernel bug where a socket option could be applied too broadly, causing unsafe cleanup of crypto sockets during an RCU callback. The public record shows a kernel fix, but no CVSS score and no KEV listing. Treat it as kernel reliability risk until vendor advisories classify impact.

Executive priority

Handle through normal kernel patch governance unless your environment has many exposed or custom Linux kernels. The business urgency is uncertain because severity and exploitation evidence are incomplete, but kernel defects can affect platform stability and should not be ignored.

Technical view

The fix restricts SO_REUSEPORT to inet sockets. The reported failure involved crypto sockets being destroyed from an RCU callback and attempting mutex acquisition in invalid context. Sources identify affected Linux kernel versions/tracks and stable kernel commits resolving the behavior. Available evidence does not establish privilege escalation, remote exploitability, or active exploitation.

Likely exposure

Exposure is most likely on Linux systems running affected kernel versions or downstream kernels that have not incorporated the listed stable fixes. Internet exposure is not established by the sources; this appears tied to local kernel socket behavior.

Exploitation context

No cited source reports active exploitation, and KEV status is false. The record contains a syzkaller-style kernel warning and call trace, but does not provide evidence of a public weaponized exploit or confirmed attack activity.

Researcher notes

The key technical issue is invalid-context cleanup involving crypto socket destruction after SO_REUSEPORT behavior changed. Public data supports remediation direction through stable commits, but does not define exploit preconditions, impact class, or reliable detection beyond version and patch-state validation.

Mitigation direction

  • Apply vendor or distribution kernel updates that include the referenced stable fixes.
  • For Debian LTS systems, review the cited Debian LTS advisory and update accordingly.
  • For custom kernels, verify whether the referenced kernel stable commits are included.
  • Prioritize systems on listed affected kernel tracks before lower-confidence assets.
  • Monitor vendor advisories for severity, impact, and backport clarification.

Validation and detection

  • Inventory Linux kernel versions across servers, appliances, containers hosts, and build images.
  • Compare running kernels against the CVE record and distribution advisories.
  • Confirm patched kernels include the SO_REUSEPORT restriction fix.
  • Reboot systems where required so the updated kernel is active.
  • Document unresolved custom or vendor kernels needing maintainer confirmation.
Prepared
Confidence
medium
Sources
8

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2024-57903 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
1ADP providers
7Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CVECVE Program Container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux8c7138b33e5c690c308b2a7085f6313fdcb3f616, 8c7138b33e5c690c308b2a7085f6313fdcb3f616, 8c7138b33e5c690c308b2a7085f6313fdcb3f616, 8c7138b33e5c690c308b2a7085f6313fdcb3f616, 8c7138b33e5c690c308b2a7085f6313fdcb3f616, 62241d6d9e497ad16372b74d2afa3340128e8e57, 1e24f532c736b3f99f3fe7c4be66414c40df5f02, d5b1db1c7ce4198bbbd51160350bdd446c8ed2ba, 50b26ba8938f1741523ca733aa9a548a12b6edd6, 7e2777fd4816cdf6bff5de9e5221514f36dddfbf, 4.9.196, 4.14.148, 4.19.78, 5.2.20, 5.3.5unaffected
LinuxLinux5.4, 0, 5.15.176, 6.1.124, 6.6.70, 6.12.9, 6.13affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.