CVE-2024-35908: linux kernel — Fix

Description

In the Linux kernel, the following vulnerability has been resolved: tls: get psock ref after taking rxlock to avoid leak At the start of tls_sw_recvmsg, we take a reference on the psock, and then call tls_rx_reader_lock. If that fails, we return directly without releasing the reference. Instead of adding a new label, just take the reference after locking has succeeded, since we don't need it before.

Is your site exposed to CVE-2024-35908?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

5.5

MEDIUM

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness Type (CWE)

CWE-401 CWE-401

Affected Products

Vendor	Product	Versions
linux	linux_kernel	6.0 — 6.1.85
linux	linux_kernel	6.2 — 6.6.26
linux	linux_kernel	6.7 — 6.8.5
linux	linux_kernel	All

References

Advisories & Patches

https://git.kernel.org/stable/c/30fabe50a7ace3e9d57cf7f9288f33ea408491c8 https://git.kernel.org/stable/c/417e91e856099e9b8a42a2520e2255e6afe024be https://git.kernel.org/stable/c/b565d294e3d5aa809566a4d819835da11997d8b3 https://git.kernel.org/stable/c/f1b7f14130d782433bc98c1e1e41ce6b4d4c3096 https://git.kernel.org/stable/c/30fabe50a7ace3e9d57cf7f9288f33ea408491c8 https://git.kernel.org/stable/c/417e91e856099e9b8a42a2520e2255e6afe024be https://git.kernel.org/stable/c/b565d294e3d5aa809566a4d819835da11997d8b3 https://git.kernel.org/stable/c/f1b7f14130d782433bc98c1e1e41ce6b4d4c3096

Frequently Asked Questions

What is CVE-2024-35908? +

In the Linux kernel, the following vulnerability has been resolved: tls: get psock ref after taking rxlock to avoid leak At the start of tls_sw_recvmsg, we take a reference on the psock, and then call tls_rx_reader_lock. If that fails, we return directly without releasing the reference. Instead of adding a new label, just take the reference after locking has succeeded, since we don't need it before. It has a CVSS v3.1 base score of 5.5 (MEDIUM).

How severe is CVE-2024-35908? +

CVE-2024-35908 has a CVSS v3.1 score of 5.5 out of 10, rated MEDIUM. This is a medium-severity vulnerability that should be remediated as part of regular maintenance.

What products are affected by CVE-2024-35908? +

CVE-2024-35908 affects products from linux, specifically: linux_kernel. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2024-35908? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2026-0646

A denial-of-service security issue exists within the 1794-AENTR adapter due to improper memory handling of CIP protocol requests. This vulnerability …

CVE-2026-20746

Virtual attribute handling in Ping Identity PingDirectory in affected versions allows only authorized users to exhaust java memory heap when …

CVE-2026-93926

Missing release of memory after effective lifetime, Missing release of resource after effective lifetime vulnerability in Apache Thrift THeaderTransport. This …

CVE-2026-53429

Missing Release of Memory after Effective Lifetime vulnerability in leandrocp mdex and mdex_native allows an attacker who controls a rendered …

CVE-2026-102716

An unauthenticated client can drain the RTSP server's packet pool with a couple of dozen requests that carry a Session …

CVE-2026-94652

Missing release of memory after effective lifetime vulnerability in Apache Thrift c++ bindings. This issue affects Apache Thrift: before 0.25.0. …

CVE-2024-35908