CVE-2024-47695

RDMA/rtrs-clt: Reset cid to con_num - 1 to stay in bounds

State: Published
Severity: 9.8 Critical
Published: Oct 21, 2024
Updated: Aug 5, 2026
Reserved: Sep 30, 2024

Description

In the Linux kernel, the following vulnerability has been resolved:

RDMA/rtrs-clt: Reset cid to con_num - 1 to stay in bounds

In the function init_conns(), after the create_con() and create_cm() for loop if something fails. In the cleanup for loop after the destroy tag, we access out of bound memory because cid is set to clt_path->s.con_num.

This commits resets the cid to clt_path->s.con_num - 1, to stay in bounds in the cleanup loop later.

Scores

CVSS	Score	Vector	Source
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	6a98d71daea186247005099758af549e6afdd244 to before 0429a4e972082e3a2351da414b1c017daaf8aed2Affected 6a98d71daea186247005099758af549e6afdd244 to before 5ac73f8191f3de41fef4f934d84d97f3aadb301fAffected 6a98d71daea186247005099758af549e6afdd244 to before 01b9be936ee8839ab9f83a7e84ee02ac6c8303c4Affected 6a98d71daea186247005099758af549e6afdd244 to before 1c50e0265fa332c94a4a182e4efa0fc70d8fad94Affected 6a98d71daea186247005099758af549e6afdd244 to before c8b7f3d9fada0d4b4b7db86bf7345cd61f1d972eAffected 6a98d71daea186247005099758af549e6afdd244 to before 3e4289b29e216a55d08a89e126bc0b37cbad9f38Affected
LinuxLinux	5.8Affected before 5.8Not affected 5.15.168 through 5.15.Not affected 6.1.113 through 6.1.Not affected 6.6.54 through 6.6.Not affected 6.10.13 through 6.10.Not affected 6.11.2 through 6.11.*Not affected 6.12 and laterNot affected

Product

Versions

LinuxLinux

6a98d71daea186247005099758af549e6afdd244 to before 0429a4e972082e3a2351da414b1c017daaf8aed2Affected
6a98d71daea186247005099758af549e6afdd244 to before 5ac73f8191f3de41fef4f934d84d97f3aadb301fAffected
6a98d71daea186247005099758af549e6afdd244 to before 01b9be936ee8839ab9f83a7e84ee02ac6c8303c4Affected
6a98d71daea186247005099758af549e6afdd244 to before 1c50e0265fa332c94a4a182e4efa0fc70d8fad94Affected
6a98d71daea186247005099758af549e6afdd244 to before c8b7f3d9fada0d4b4b7db86bf7345cd61f1d972eAffected
6a98d71daea186247005099758af549e6afdd244 to before 3e4289b29e216a55d08a89e126bc0b37cbad9f38Affected

LinuxLinux

5.8Affected
before 5.8Not affected
5.15.168 through 5.15.*Not affected
6.1.113 through 6.1.*Not affected
6.6.54 through 6.6.*Not affected
6.10.13 through 6.10.*Not affected
6.11.2 through 6.11.*Not affected
6.12 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.