CVE-2024-0641: Kernel: deadlock leading to denial of service in tipc_crypto_key_revoke

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-01-17 · updated 2026-06-17
Weakness: CWE-833

Description

A denial of service vulnerability was found in tipc_crypto_key_revoke in net/tipc/crypto.c in the Linux kernel’s TIPC subsystem. This flaw allows guests with local user privileges to trigger a deadlock and potentially crash the system.

Affected products

Linux kernel: before 6.6; 6.6-rc1, 6.6-rc2, 6.6-rc3, 6.6-rc4 — fixed in 6.6
Red Hat Enterprise Linux: 8.0, 9.0

How to fix

Upgrade to a fixed version: Linux kernel 6.6. Check the vendor advisory for mitigations.

References

https://access.redhat.com/security/cve/CVE-2024-0641
https://bugzilla.redhat.com/show_bug.cgi?id=2258757
https://github.com/torvalds/linux/commit/08e50cf071847323414df0835109b6f3560d44f5
https://access.redhat.com/security/cve/CVE-2024-0641
https://bugzilla.redhat.com/show_bug.cgi?id=2258757
https://github.com/torvalds/linux/commit/08e50cf071847323414df0835109b6f3560d44f5

Get alerted when CVE-2024-0641 or the next vulnerability affects your stack