CVE-2024-41007

tcp: avoid too many retransmit packets

State: Published
Severity: 7.5 High
Published: Jul 15, 2024
Updated: Aug 5, 2026
Reserved: Jul 12, 2024

Description

In the Linux kernel, the following vulnerability has been resolved:

tcp: avoid too many retransmit packets

If a TCP socket is using TCP_USER_TIMEOUT, and the other peer retracted its window to zero, tcp_retransmit_timer() can retransmit a packet every two jiffies (2 ms for HZ=1000), for about 4 minutes after TCP_USER_TIMEOUT has 'expired'.

The fix is to make sure tcp_rtx_probe0_timed_out() takes icsk->icsk_user_timeout into account.

Before blamed commit, the socket would not timeout after icsk->icsk_user_timeout, but would use standard exponential backoff for the retransmits.

Also worth noting that before commit e89688e3e978 ("net: tcp: fix unexcepted socket die when snd_wnd is 0"), the issue would last 2 minutes instead of 4.

Scores

CVSS	Score	Vector	Source
3.1	7.5 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	b701a99e431db784714c32fc6b68123045714679 to before 7bb7670f92bfbd05fc41a8f9a8f358b7ffed65f4Affected b701a99e431db784714c32fc6b68123045714679 to before d2346fca5bed130dc712f276ac63450201d52969Affected b701a99e431db784714c32fc6b68123045714679 to before 5d7e64d70a11d988553a08239c810a658e841982Affected b701a99e431db784714c32fc6b68123045714679 to before 04317a2471c2f637b4c49cbd0e9c0d04a519f570Affected b701a99e431db784714c32fc6b68123045714679 to before e113cddefa27bbf5a79f72387b8fbd432a61a466Affected b701a99e431db784714c32fc6b68123045714679 to before dfcdd7f89e401d2c6616be90c76c2fac3fa98fdeAffected b701a99e431db784714c32fc6b68123045714679 to before 66cb64a1d2239cd0309f9b5038b05462570a5be1Affected b701a99e431db784714c32fc6b68123045714679 to before 97a9063518f198ec0adb2ecb89789de342bb8283Affected
LinuxLinux	4.19Affected before 4.19Not affected 4.19.318 through 4.19.Not affected 5.4.280 through 5.4.Not affected 5.10.222 through 5.10.Not affected 5.15.163 through 5.15.Not affected 6.1.100 through 6.1.Not affected 6.6.41 through 6.6.Not affected 6.9.10 through 6.9.*Not affected 6.10 and laterNot affected

Product

Versions

LinuxLinux

b701a99e431db784714c32fc6b68123045714679 to before 7bb7670f92bfbd05fc41a8f9a8f358b7ffed65f4Affected
b701a99e431db784714c32fc6b68123045714679 to before d2346fca5bed130dc712f276ac63450201d52969Affected
b701a99e431db784714c32fc6b68123045714679 to before 5d7e64d70a11d988553a08239c810a658e841982Affected
b701a99e431db784714c32fc6b68123045714679 to before 04317a2471c2f637b4c49cbd0e9c0d04a519f570Affected
b701a99e431db784714c32fc6b68123045714679 to before e113cddefa27bbf5a79f72387b8fbd432a61a466Affected
b701a99e431db784714c32fc6b68123045714679 to before dfcdd7f89e401d2c6616be90c76c2fac3fa98fdeAffected
b701a99e431db784714c32fc6b68123045714679 to before 66cb64a1d2239cd0309f9b5038b05462570a5be1Affected
b701a99e431db784714c32fc6b68123045714679 to before 97a9063518f198ec0adb2ecb89789de342bb8283Affected

LinuxLinux

4.19Affected
before 4.19Not affected
4.19.318 through 4.19.*Not affected
5.4.280 through 5.4.*Not affected
5.10.222 through 5.10.*Not affected
5.15.163 through 5.15.*Not affected
6.1.100 through 6.1.*Not affected
6.6.41 through 6.6.*Not affected
6.9.10 through 6.9.*Not affected
6.10 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.