{
  "cveId": "CVE-2024-43887",
  "url": "https://patchblox.com/security/cve/CVE-2024-43887",
  "summary": "CVE-2024-43887 is fixed in linux on 1 platform, first by DEBIAN-CVE-2024-43887, released August 26, 2024. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "linux: In the Linux kernel, the following vulnerability has been resolved:  net/tcp: Disable TCP-AO static key after RCU gra...",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  net/tcp: Disable TCP-AO static key after RCU grace period  The lifetime of TCP-AO static_key is the same as the last tcp_ao_info. On the socket destruction tcp_ao_info ceases to be with RCU grace period, while tcp-ao static branch is currently deferred destructed. The static key definition is : DEFINE_STATIC_KEY_DEFERRED_FALSE(tcp_ao_needed, HZ);  which means that if RCU grace period is delayed by more than a second and tcp_ao_needed is in the process of disablement, other CPUs may yet see tcp_ao_info which atent dead, but soon-to-be. And that breaks the assumption of static_key_fast_inc_not_disabled().  See the comment near the definition: \u003E * The caller must make sure that the static key can\u0027t get disabled while \u003E * in this function. It doesn\u0027t patch jump labels, only adds a user to \u003E * an already enabled static key.  Originally it was introduced in commit eb8c507296f6 (\u0022jump_label: Prevent key-\u003Eenabled int overflow\u0022), which is needed for the atomic contexts, one of which would be the creation of a full socket from a request socket. In that atomic context, it\u0027s known by the presence of the key (md5/ao) that the static branch is already enabled. So, the ref counter for that static branch is just incremented instead of holding the proper mutex. static_key_fast_inc_not_disabled() is just a helper for such usage case. But it must not be used if the static branch could get disabled in parallel as it\u0027s not protected by jump_label_mutex and as a result, races with jump_label_update() implementation details.  Happened on netdev test-bot[1], so not a theoretical issue:  [] jump_label: Fatal kernel bug, unexpected op at tcp_inbound_hash\u002B0x1a7/0x870 [ffffffffa8c4e9b7] (eb 50 0f 1f 44 != 66 90 0f 1f 00)) size:2 type:1 [] ------------[ cut here ]------------ [] kernel BUG at arch/x86/kernel/jump_label.c:73! [] Oops: invalid opcode: 0000 [#1] PREEMPT SMP KASAN NOPTI [] CPU: 3 PID: 243 Comm: kworker/3:3 Not tainted 6.10.0-virtme #1 [] Hardware name: QEMU Standard PC (i440FX \u002B PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014 [] Workqueue: events jump_label_update_timeout [] RIP: 0010:__jump_label_patch\u002B0x2f6/0x350 ... [] Call Trace: []  \u003CTASK\u003E []  arch_jump_label_transform_queue\u002B0x6c/0x110 []  __jump_label_update\u002B0xef/0x350 []  __static_key_slow_dec_cpuslocked.part.0\u002B0x3c/0x60 []  jump_label_update_timeout\u002B0x2c/0x40 []  process_one_work\u002B0xe3b/0x1670 []  worker_thread\u002B0x587/0xce0 []  kthread\u002B0x28a/0x350 []  ret_from_fork\u002B0x31/0x70 []  ret_from_fork_asm\u002B0x1a/0x30 []  \u003C/TASK\u003E [] Modules linked in: veth [] ---[ end trace 0000000000000000 ]--- [] RIP: 0010:__jump_label_patch\u002B0x2f6/0x350  [1]: https://netdev-3.bots.linux.dev/vmksft-tcp-ao-dbg/results/696681/5-connect-deny-ipv6/stderr",
  "published": "2024-08-26T11:15:03Z",
  "severity": "medium",
  "cvss": 4.7,
  "cvssVector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
  "epss": 0.00189,
  "epssPercentile": 0.08617,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "6.10.6-1",
      "fix": "DEBIAN-CVE-2024-43887",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2024-43887",
      "released": "2024-08-26T11:15:03Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "6.10.6-1",
      "fix": "DEBIAN-CVE-2024-43887",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2024-43887",
      "released": "2024-08-26T11:15:03Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T06:59:42Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}