CVE-2024-36905
tcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets
CVE-2024-36905: tcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets. Not in the CISA KEV catalog. Medium advisory severity (CVSS 5.5, Red Hat).
Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.
CVE-2024-36905 at a glance
- CISA KEV
- Not listed (catalog checked )
- Highest advisory severity
- Medium
- CVSS base score
- 5.5 (Red Hat)
- Fixed releases
- Red Hat: kernel-rt-0:4.18.0-553.16.1.rt7.357.el8_10, kernel-0:4.18.0-553.16.1.el8_10, kernel-0:5.14.0-503.11.1.el9_5, kernel-0:5.14.0-427.57.1.el9_4, RHSA-2024:5102, RHSA-2024:5101 and 2 more in the advisory
- Vendor advisories
- 1 from Red Hat
- VulniPulse record
- Published
Scores, vectors, weaknesses and fixed releases are quoted from vendor advisories that cover only CVE-2024-36905; bulletin-wide values are not repeated here.
Is CVE-2024-36905 exploited?
No exploitation is reported in the sources VulniPulse tracks: CVE-2024-36905 is not in the CISA KEV catalog (checked ) and no tracked advisory for it reports exploitation. That is not proof the vulnerability cannot be exploited.
How do I fix CVE-2024-36905?
Upgrade to a fixed release named by the vendor:
- Red Hat: kernel-rt-0:4.18.0-553.16.1.rt7.357.el8_10, kernel-0:4.18.0-553.16.1.el8_10, kernel-0:5.14.0-503.11.1.el9_5, kernel-0:5.14.0-427.57.1.el9_4, RHSA-2024:5102, RHSA-2024:5101
Vendor advisory comparison
Red Hat
1 advisory- Advisory severityMedium5.5
Medium [CVE-2024-36905] tcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets
CVE-2024-36905Source published Source updated
In the Linux kernel, the following vulnerability has been resolved: tcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets TCP_SYN_RECV state is really special, it is only used by cross-syn connections, mostly used by fuzzers. In the following crash [1], syzbot managed to trigger a divide by zero in tcp_rcv_space_adjust() A socket makes the following state transitions, without ever calling tcp_init_transfer(), meaning tcp_init_buffer_space() is also not called. TCP_CLOSE connect() TCP_SYN_SENT TCP_SYN_RECV shutdown() -> tcp_shutdown(sk, SEND_SHUTDOWN) TCP_FIN_WAIT1 To fix this issue, change tcp_shutdown() to not perform a TCP_SYN_RECV -> TCP_FIN_WAIT1 transition, which makes no sense anyway. When tcp_rcv_state_process() later changes socket state from TCP_SYN_RECV to TCP_ESTABLISH…
- Affected products in this advisory
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9.4 Extended Update Support
- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 7
1 more entries in the full advisory.
- Source-reported affected versions
- Affected-version details not available in this record.
- Source-reported fixed versions
- kernel-rt-0:4.18.0-553.16.1.rt7.357.el8_10
- kernel-0:4.18.0-553.16.1.el8_10
- kernel-0:5.14.0-503.11.1.el9_5
- kernel-0:5.14.0-427.57.1.el9_4
4 more entries in the full advisory.
- Mitigation guidance
- No mitigation guidance extracted; consult the source.
Browse the latest tracked CVEs or the CVEs listed in CISA KEV.
Android app · Google Play
Monitor future Red Hat CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.