{"id":"CVE-2024-58239","title":"In the Linux kernel, the following vulnerability has been resolved:\n\ntls: stop recv() if initial process_rx_list gave us non-DATA\n\nIf we have a non-DATA record on the rx_list and another record of the\nsame type still on the queue, we wil…","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\ntls: stop recv() if initial process_rx_list gave us non-DATA\n\nIf we have a non-DATA record on the rx_list and another record of the\nsame type still on the queue, we wil…","severity":"high","cvss":8.2,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","cwe":["CWE-241"],"vendor":"linux","product":"linux_kernel","affected":["linux_kernel >= 5.1, < 5.4.270","linux_kernel >= 5.5, < 5.10.211","linux_kernel >= 5.11, < 5.15.150","linux_kernel >= 5.16, < 6.1.80","linux_kernel >= 6.2, < 6.6.19","linux_kernel >= 6.7, < 6.7.7","linux_kernel = 6.8"],"patched":["linux_kernel 6.7.7"],"published":"2025-08-22","updated":"2026-10-15","sourceUpdated":"2026-10-15T22:18:06.467","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2024-58239","references":[{"url":"https://git.kernel.org/stable/c/31e10d6cb0c9532ff070cf50da1657c3acee9276","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3b952d8fdfcf6fd8ea0b8954bc9277642cf0977f","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4338032aa90bd1d5b33a4274e8fa8347cda5ee09","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6756168add1c6c3ef1c32c335bb843a5d1f99a75","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a4ed943882a8fc057ea5a67643314245e048bbdd","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f310143961e2d9a0479fca117ce869f8aaecc140","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/fdfbaec5923d9359698cbb286bc0deadbb717504","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-58239.json"},{"url":"https://access.redhat.com/security/cve/CVE-2024-58239"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2390320"},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-58239"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-58239"},{"url":"https://lore.kernel.org/linux-cve-announce/2025082210-CVE-2024-58239-dd4f@gregkh/T"},{"url":"https://access.redhat.com/errata/RHSA-2024:9315"}],"tags":["nvd","exploit-available","csaf","vex","red-hat","cve.org","score-dispute"],"epss":0.00358,"epssPercentile":0.29318,"exploits":{"github":2,"githubRepos":["https://github.com/khoatran107/cve-2024-58239","https://github.com/khoatran107/cve-2025-39682"],"checkedAt":"2026-10-27T18:12:44.900Z"},"exploitAvailable":true,"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-10-15T21:42:29.347860Z"},"scores":{"nvd":8.2,"vendor":5.9,"cna":8.2},"ingestedAt":"2026-10-15T22:48:25.465Z","slug":"CVE-2024-58239","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ntls: stop recv() if initial process_rx_list gave us non-DATA\n\nIf we have a non-DATA record on the rx_list and another record of the\nsame type still on the queue, we will end up merging them:\n - process_rx_list copies the non-DATA record\n - we start the loop and process the first available record since it's\n   of the same type\n - we break out of the loop since the record was not DATA\n\nJust check the record type and jump to the end in case process_rx_list\ndid some work.\n\n## Affected\n\n- `linux_kernel >= 5.1, < 5.4.270`\n- `linux_kernel >= 5.5, < 5.10.211`\n- `linux_kernel >= 5.11, < 5.15.150`\n- `linux_kernel >= 5.16, < 6.1.80`\n- `linux_kernel >= 6.2, < 6.6.19`\n- `linux_kernel >= 6.7, < 6.7.7`\n- `linux_kernel = 6.8`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `linux_kernel 6.7.7`\n\n## Vendor advisories\n\n- **RHSA-2024:9315** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat CodeReady Linux Builder (v. 9), Red Hat Enterprise Linux Real Time for NFV (v. 9), Red Hat Enterprise Linux Real Time (v. 9) · released 2024-11-12 · [advisory](https://access.redhat.com/errata/RHSA-2024:9315)\n- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9 · no fix planned: Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9 · updated 2026-10-16 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-58239.json)","depth":"midnight","depthScore":57,"depthScoreParts":{"impact":45.1,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[{"seq":230059,"id":"CVE-2024-58239","ts":1793124778462,"field":"cvss","old":"5.9","new":"8.2"},{"seq":230058,"id":"CVE-2024-58239","ts":1793124778462,"field":"severity","old":"medium","new":"high"},{"seq":223741,"id":"CVE-2024-58239","ts":1792238383320,"field":"cvss","old":"8.2","new":"5.9"},{"seq":223740,"id":"CVE-2024-58239","ts":1792238383320,"field":"severity","old":"high","new":"medium"}]}