{"id":"CVE-2024-36489","title":"In the Linux kernel, the following vulnerability has been resolved:\n\ntls: fix missing memory barrier in tls_init\n\nIn tls_init(), a write memory barrier is missing, and store-store\nreordering may cause NULL dereference in tls_{setsockopt,…","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\ntls: fix missing memory barrier in tls_init\n\nIn tls_init(), a write memory barrier is missing, and store-store\nreordering may cause NULL dereference in tls_{setsockopt,…","severity":"medium","cvss":5.5,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","cwe":["CWE-476"],"vendor":"linux","product":"linux_kernel","affected":["linux_kernel >= 5.7, < 5.10.219","linux_kernel >= 5.11, < 5.15.161","linux_kernel >= 5.16, < 6.1.93","linux_kernel >= 6.2, < 6.6.33","linux_kernel >= 6.7, < 6.9.4"],"patched":["linux_kernel 6.9.4"],"published":"2024-06-21","updated":"2026-10-15","sourceUpdated":"2026-10-15T01:18:23.000","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2024-36489","references":[{"url":"https://git.kernel.org/stable/c/2c260a24cf1c4d30ea3646124f766ee46169280b","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/335c8f1566d8e44c384d16b450a18554896d4e8b","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/91e61dd7a0af660408e87372d8330ceb218be302","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ab67c2fd3d070a21914d0c31319d3858ab4e199c","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d72e126e9a36d3d33889829df8fc90100bb0e071","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ef21007a7b581c7fe64d5a10c320880a033c837b","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/2c260a24cf1c4d30ea3646124f766ee46169280b","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://git.kernel.org/stable/c/335c8f1566d8e44c384d16b450a18554896d4e8b","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://git.kernel.org/stable/c/91e61dd7a0af660408e87372d8330ceb218be302","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://git.kernel.org/stable/c/ab67c2fd3d070a21914d0c31319d3858ab4e199c","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://git.kernel.org/stable/c/d72e126e9a36d3d33889829df8fc90100bb0e071","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://git.kernel.org/stable/c/ef21007a7b581c7fe64d5a10c320880a033c837b","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-265688.html","label":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-613116.html","label":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"tags":["nvd","cve.org"],"epss":0.00255,"epssPercentile":0.15939,"ingestedAt":"2026-10-15T03:30:12.711Z","ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2024-09-10T17:09:28.291219Z"},"slug":"CVE-2024-36489","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ntls: fix missing memory barrier in tls_init\n\nIn tls_init(), a write memory barrier is missing, and store-store\nreordering may cause NULL dereference in tls_{setsockopt,getsockopt}.\n\nCPU0                               CPU1\n-----                              -----\n// In tls_init()\n// In tls_ctx_create()\nctx = kzalloc()\nctx->sk_proto = READ_ONCE(sk->sk_prot) -(1)\n\n// In update_sk_prot()\nWRITE_ONCE(sk->sk_prot, tls_prots)     -(2)\n\n                                   // In sock_common_setsockopt()\n                                   READ_ONCE(sk->sk_prot)->setsockopt()\n\n                                   // In tls_{setsockopt,getsockopt}()\n                                   ctx->sk_proto->setsockopt()    -(3)\n\nIn the above scenario, when (1) and (2) are reordered, (3) can observe\nthe NULL value of ctx->sk_proto, causing NULL dereference.\n\nTo fix it, we rely on rcu_assign_pointer() which implies the release\nbarrier semantic. By moving rcu_assign_pointer() after ctx->sk_proto is\ninitialized, we can ensure that ctx->sk_proto are visible when\nchanging sk->sk_prot.\n\n## Affected\n\n- `linux_kernel >= 5.7, < 5.10.219`\n- `linux_kernel >= 5.11, < 5.15.161`\n- `linux_kernel >= 5.16, < 6.1.93`\n- `linux_kernel >= 6.2, < 6.6.33`\n- `linux_kernel >= 6.7, < 6.9.4`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `linux_kernel 6.9.4`","depth":"sunlit","depthScore":30,"depthScoreParts":{"impact":30.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}