CVE-2024-38544 in the critical feed json
RDMA/rxe: Fix seg fault in rxe_comp_queue_pkt
published 2024-06-19 2 y ago modified 2026-08-05 3 mo ago also EUVD-2024-37407
- cvss
- 9.8
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.8%
- EPSS 0.8% chance of exploitation in 30 days, percentile 57%
- public exploits
- 0
- none known
Summary
In the Linux kernel, the following vulnerability has been resolved:
RDMA/rxe: Fix seg fault in rxe_comp_queue_pkt
In rxe_comp_queue_pkt() an incoming response packet skb is enqueued to the resp_pkts queue and then a decision is made whether to run the completer task inline or schedule it. Finally the skb is dereferenced to bump a 'hw' performance counter. This is wrong because if the completer task is already running in a separate thread it may have already processed the skb and freed it which can cause a seg fault. This has been observed infrequently in testing at high scale.
This patch fixes this by changing the order of enqueuing the packet until after the counter is accessed.
Patch / fix
- Linux Linux 5.4.285, 5.10.227, 5.15.168, 6.1.93, 6.6.33, 6.8.12, 6.9.3, 6.10
- linux Debian 12 6.1.94-1
- linux Debian 14, Debian 13 6.8.12-1
debian advisories DEBIAN-CVE-2024-38544
- linux Ubuntu 20.04 LTS 5.4.0-208.228
- linux Ubuntu 22.04 LTS 5.15.0-127.137
- linux Ubuntu 24.04 LTS 6.8.0-40.40
- linux-aws Ubuntu 20.04 LTS 5.4.0-1140.150
- linux-aws Ubuntu 22.04 LTS 5.15.0-1073.79
- linux-aws Ubuntu 24.04 LTS 6.8.0-1013.14
- linux-gcp Ubuntu 20.04 LTS 5.4.0-1143.152
- linux-gcp Ubuntu 22.04 LTS 5.15.0-1072.80
ubuntu advisories UBUNTU-CVE-2024-38544
Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- kernel RHEL 9 5.14.0-427.33.1.el9_4
- rv RHEL 9 5.14.0-427.33.1.el9_4
- perf RHEL 9 5.14.0-427.33.1.el9_4
- rtla RHEL 9 5.14.0-427.33.1.el9_4
- bpftool RHEL 9 7.3.0-427.33.1.el9_4
- libperf RHEL 9 5.14.0-427.33.1.el9_4
- kernel-rt RHEL 9 5.14.0-427.33.1.el9_4
- kernel-64k RHEL 9 5.14.0-427.33.1.el9_4
red hat advisories RHSA-2024:5928
- kernel-rt Linux Micro 6.0 6.4.0-9.1
- kernel-source-rt Linux Micro 6.0 6.4.0-9.1
- kernel-source Linux Micro 6.0 6.4.0-18.1
- kernel-default Linux Micro 6.0 6.4.0-18.1
- kernel-kvmsmall Linux Micro 6.0 6.4.0-18.1
- kernel-default-base Linux Micro 6.0 6.4.0-17.1.1.51
- kernel-rt Real Time Module 15 SP6, openSUSE Leap 15.6 6.4.0-150600.10.5.1
- kernel-syms-rt Real Time Module 15 SP6, openSUSE Leap 15.6 6.4.0-150600.10.5.1
suse advisories SUSE-SU-2025:20028-1SUSE-SU-2025:20008-1SUSE-SU-2024:2973-1SUSE-SU-2024:2939-1SUSE-SU-2024:2896-1SUSE-SU-2024:2571-1
- kernel AlmaLinux 9 5.14.0-427.33.1.el9_4
- rv AlmaLinux 9 5.14.0-427.33.1.el9_4
- perf AlmaLinux 9 5.14.0-427.33.1.el9_4
- rtla AlmaLinux 9 5.14.0-427.33.1.el9_4
- bpftool AlmaLinux 9 7.3.0-427.33.1.el9_4
- libperf AlmaLinux 9 5.14.0-427.33.1.el9_4
- kernel-rt AlmaLinux 9 5.14.0-427.33.1.el9_4
- kernel-64k AlmaLinux 9 5.14.0-427.33.1.el9_4
almalinux advisories ALSA-2024:5928
- git.kernel.org/stable/c/c91fb72a2ca6480d8d77262eef52dc5b178463a3 commit
- git.kernel.org/stable/c/de5a059e36657442b5637cc16df5163e435b9cb4 commit
- git.kernel.org/stable/c/e0e14dd35d4242340c7346aac60c7ff8fbf87ffc commit
- git.kernel.org/stable/c/faa8d0ecf6c9c7c2ace3ca3e552180ada6f75e19 commit
- git.kernel.org/stable/c/21b4c6d4d89030fd4657a8e7c8110fd941049794 commit
- git.kernel.org/stable/c/bbad88f111a1829f366c189aa48e7e58e57553fc commit
- git.kernel.org/stable/c/30df4bef8b8e183333e9b6e9d4509d552c7da6eb commit
- git.kernel.org/stable/c/2b23b6097303ed0ba5f4bc036a1c07b6027af5c6 commit
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2024-38544 updated cvss 5.7
kernel: RDMA/rxe: Fix seg fault in rxe_comp_queue_pkt
-
Red Hat Enterprise Linux 7 perf, kernel, bpftool, kernel-rt, python-perf, kernel-kdump, +8 moreaffected: workaround, no fix planned “Out of support scope”
-
Red Hat Enterprise Linux 8 perf, kernel, bpftool, kernel-rt, kernel-core, kernel-tools, +29 moreaffected: workaround, no fix planned “Will not fix”
-
Red Hat Enterprise Linux AppStream (v. 9) rv 5.14.0-427.33.1.el9_4, perf 5.14.0-427.33.1.el9_4, rtla 5.14.0-427.33.1.el9_4, kernel-devel-matched 5.14.0-427.33.1.el9_4, kernel-64k-devel-matched 5.14.0-427.33.1.el9_4, kernel-debug-devel-matched 5.14.0-427.33.1.el9_4, +6 more Red Hat Enterprise Linux BaseOS (v. 9) bpftool 7.3.0-427.33.1.el9_4, kernel 5.14.0-427.33.1.el9_4, kernel-64k 5.14.0-427.33.1.el9_4, kernel-core 5.14.0-427.33.1.el9_4, kernel-tools 5.14.0-427.33.1.el9_4, python3-perf 5.14.0-427.33.1.el9_4, +28 more Red Hat Enterprise Linux CRB (v. 9) libperf 5.14.0-427.33.1.el9_4, kernel-debuginfo-common-s390x 5.14.0-427.33.1.el9_4, kernel-debuginfo-common-x86_64 5.14.0-427.33.1.el9_4, kernel-debuginfo-common-aarch64 5.14.0-427.33.1.el9_4, kernel-debuginfo-common-ppc64le 5.14.0-427.33.1.el9_4 Red Hat Enterprise Linux NFV (v. 9) kernel-rt 5.14.0-427.33.1.el9_4, kernel-rt-kvm 5.14.0-427.33.1.el9_4, kernel-rt-core 5.14.0-427.33.1.el9_4, kernel-rt-modules 5.14.0-427.33.1.el9_4, kernel-rt-debug-kvm 5.14.0-427.33.1.el9_4, kernel-rt-debug-core 5.14.0-427.33.1.el9_4, +6 more Red Hat Enterprise Linux RT (v. 9) kernel-rt 5.14.0-427.33.1.el9_4, kernel-rt-core 5.14.0-427.33.1.el9_4, kernel-rt-modules 5.14.0-427.33.1.el9_4, kernel-rt-debug-core 5.14.0-427.33.1.el9_4, kernel-rt-modules-core 5.14.0-427.33.1.el9_4, kernel-rt-debug-modules 5.14.0-427.33.1.el9_4, +4 morefixed: vendor fix RHSA-2024:5928
-
Red Hat Enterprise Linux 6 perf, kernel, python-perf, kernel-kdump, kernel-firmware, kernel-bootwrapper, +1 more Red Hat Enterprise Linux 9 kernel-rt, kernel-rt-kvm, kernel-rt-core, kernel-rt-modules, kernel-rt-debug-kvm, kernel-rt-debug-core, +12 morenot affected: vulnerable code not present
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
0.81% chance of exploitation in the next 30 days, higher than 57% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| CISA ADP | 3.1 | 6.3 | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H |
| NVD | 3.1 | 6.3 | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H |
| CNA | 3.1 | 6.3 | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H |
Affected products
- Linux Linux
Classification
- Weakness
-
- CWE-416 Use After Free
- Technology feeds
References
-
git.kernel.org
/stable/c/c91fb72a2ca6480d8d77262eef52dc5b178463a3
patch
-
git.kernel.org
/stable/c/de5a059e36657442b5637cc16df5163e435b9cb4
patch
-
git.kernel.org
/stable/c/e0e14dd35d4242340c7346aac60c7ff8fbf87ffc
patch
-
git.kernel.org
/stable/c/faa8d0ecf6c9c7c2ace3ca3e552180ada6f75e19
patch
-
git.kernel.org
/stable/c/21b4c6d4d89030fd4657a8e7c8110fd941049794
patch
-
git.kernel.org
/stable/c/bbad88f111a1829f366c189aa48e7e58e57553fc
patch
-
git.kernel.org
/stable/c/30df4bef8b8e183333e9b6e9d4509d552c7da6eb
patch
-
git.kernel.org
/stable/c/2b23b6097303ed0ba5f4bc036a1c07b6027af5c6
patch
- lists.debian.org /debian-lts-announce/2025/03/msg00002.html
Sources
- CVE List CVE-2024-38544
- NVD CVE-2024-38544
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.