Medium 5.5Published Jun 21, 2024

CVE-2024-36489tls: fix missing memory barrier in tls_init

Updated under an hour ago (Oct 27, 2026, 12:00 PM ET)

Does this affect you?

It affects Linux and 5 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: tls: fix missing memory barrier in tls_init In tls_init(), a write memory barrier is missing, and store-store reordering may cause NULL dereference in tls_{setsockopt,getsockopt}. CPU0 CPU1 ----- ----- // In tls_init() // In tls_ctx_create() ctx = kzalloc() ctx->sk_proto = READ_ONCE(sk->sk_prot) -(1) // In update_sk_prot() WRITE_ONCE(sk->sk_prot, tls_prots) -(2) // In sock_common_setsockopt() READ_ONCE(sk->sk_prot)->setsockopt() // In tls_{setsockopt,getsockopt}() ctx->sk_proto->setsockopt() -(3) In the above scenario, when (1) and (2) are reordered, (3) can observe the NULL value of ctx->sk_proto, causing NULL dereference. To fix it, we rely on rcu_assign_pointer() which implies the release barrier semantic. By moving rcu_assign_pointer() after ctx->sk_proto is initialized, we can ensure that ctx->sk_proto are visible when changing sk->sk_prot.

CVSS: 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 14, 2026
First seen by InfoSec Signals: Oct 14, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from d5bee7374b68de3c44586d46e9e61ffc97a1e886 before d72e126e9a36d3d33889829df8fc90100bb0e071; from d5bee7374b68de3c44586d46e9e61ffc97a1e886 before 2c260a24cf1c4d30ea3646124f766ee46169280b; from d5bee7374b68de3c44586d46e9e61ffc97a1e886 before 335c8f1566d8e44c384d16b450a18554896d4e8b; from d5bee7374b68de3c44586d46e9e61ffc97a1e886 before ab67c2fd3d070a21914d0c31319d3858ab4e199c; from d5bee7374b68de3c44586d46e9e61ffc97a1e886 before ef21007a7b581c7fe64d5a10c320880a033c837b; from d5bee7374b68de3c44586d46e9e61ffc97a1e886 before 91e61dd7a0af660408e87372d8330ceb218be302	CNA record
Siemens RUGGEDCOM RST2428P siemens:ruggedcom_rst2428p (from the name)	before V3.1	CISA ADP
Siemens SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family siemens:scalance_xc_300_xr_300_xc_400_xr_500wg_xr_500_family (from the name)	all versions not affected	CISA ADP
Siemens SCALANCE XCM-/XRM-/XCH-/XRH-300 family siemens:scalance_xcm_xrm_xch_xrh_300_family (from the name)	before V3.1	CISA ADP
Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem siemens:simatic_s7_1500_tm_mfp_gnu_linux_subsystem (from the name)	before V1.1.1	CISA ADP
linux linux_kernel linux:linux_kernel	from 5.7 before 5.10.219; from 5.11 before 5.15.161; from 5.16 before 6.1.93; from 6.2 before 6.6.33; from 6.7 before 6.9.4	NVD

References

References

https://git.kernel.org/stable/c/d72e126e9a36d3d33889829df8fc90100bb0e071	patch
https://git.kernel.org/stable/c/2c260a24cf1c4d30ea3646124f766ee46169280b	patch
https://git.kernel.org/stable/c/335c8f1566d8e44c384d16b450a18554896d4e8b	patch
https://git.kernel.org/stable/c/ab67c2fd3d070a21914d0c31319d3858ab4e199c	patch
https://git.kernel.org/stable/c/ef21007a7b581c7fe64d5a10c320880a033c837b	patch
https://git.kernel.org/stable/c/91e61dd7a0af660408e87372d8330ceb218be302	patch
https://cert-portal.siemens.com/productcert/html/ssa-265688.html
https://cert-portal.siemens.com/productcert/html/ssa-613116.html

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.