Riskcovery

CVE-2024-27402

phonet/pep: fix racy skb_queue_empty() use

State
Published
Severity
5.8 Medium
Published
May 17, 2024
Updated
May 11, 2026
Reserved
Feb 25, 2024

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

phonet/pep: fix racy skb_queue_empty() use

The receive queues are protected by their respective spin-lock, not the socket lock. This could lead to skb_peek() unexpectedly returning NULL or a pointer to an already dequeued socket buffer.

Scores

CVSSScoreVectorSource
3.15.8 MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:HCISA-ADP

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 9641458d3ec42def729fde64669abf07f3220cd5 to before 7d3914a477eed92b48c493a8631cc4554ab4fd4fAffected
  • 9641458d3ec42def729fde64669abf07f3220cd5 to before 9d5523e065b568e79dfaa2ea1085a5bcf74baf78Affected
  • 9641458d3ec42def729fde64669abf07f3220cd5 to before 0a9f558c72c47472c38c05fcb72c70abb9104277Affected
  • 9641458d3ec42def729fde64669abf07f3220cd5 to before 8ef4fcc7014b9f93619851d6b78d6cc2789a4c88Affected
  • 9641458d3ec42def729fde64669abf07f3220cd5 to before 7d2a894d7f487dcb894df023e9d3014cf5b93fe5Affected
LinuxLinux
  • 2.6.28Affected
  • before 2.6.28Not affected
  • 5.15.181 through 5.15.*Not affected
  • 6.1.80 through 6.1.*Not affected
  • 6.6.19 through 6.6.*Not affected
  • 6.7.7 through 6.7.*Not affected
  • 6.8 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.