What’s Vulnerable › Vulnerabilities

CVE-2024-0639: Kernel: potential deadlock on &net->sctp.addr_wq_lock leading to dos

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-01-17 · updated 2026-07-21
• Weakness: CWE-833

Description

A denial of service vulnerability due to a deadlock was found in sctp_auto_asconf_init in net/sctp/socket.c in the Linux kernel’s SCTP subsystem. This flaw allows guests with local user privileges to trigger a deadlock and potentially crash the system.

Affected products

• Linux kernel: through 6.4.16
• Red Hat Enterprise Linux: 8.0, 9.0

References

• https://access.redhat.com/errata/RHSA-2023:6583
• https://access.redhat.com/security/cve/CVE-2024-0639
• https://bugzilla.redhat.com/show_bug.cgi?id=2258754
• https://github.com/torvalds/linux/commit/6feb37b3b06e9049e20dcf7e23998f92c9c5be9a
• https://access.redhat.com/security/cve/CVE-2024-0639
• https://bugzilla.redhat.com/show_bug.cgi?id=2258754
• https://github.com/torvalds/linux/commit/6feb37b3b06e9049e20dcf7e23998f92c9c5be9a

Get alerted when CVE-2024-0639 or the next vulnerability affects your stack