---
id: CVE-2024-58239
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  tls: stop recv() if initial process_rx_list gave us non-DATA

  If we have a non-DATA record on the rx_list and another record of the
  same type still on the queue, we wil…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  tls: stop recv() if initial process_rx_list gave us non-DATA

  If we have a non-DATA record on the rx_list and another record of the
  same type still on the queue, we wil…
severity: high
cvss: 8.2
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H'
cwe:
  - CWE-241
vendor: linux
product: linux_kernel
affected:
  - 'linux_kernel >= 5.1, < 5.4.270'
  - 'linux_kernel >= 5.5, < 5.10.211'
  - 'linux_kernel >= 5.11, < 5.15.150'
  - 'linux_kernel >= 5.16, < 6.1.80'
  - 'linux_kernel >= 6.2, < 6.6.19'
  - 'linux_kernel >= 6.7, < 6.7.7'
  - linux_kernel = 6.8
patched:
  - linux_kernel 6.7.7
published: '2025-08-22'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T22:18:06.467'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2024-58239'
references:
  - url: 'https://git.kernel.org/stable/c/31e10d6cb0c9532ff070cf50da1657c3acee9276'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/3b952d8fdfcf6fd8ea0b8954bc9277642cf0977f'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/4338032aa90bd1d5b33a4274e8fa8347cda5ee09'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/6756168add1c6c3ef1c32c335bb843a5d1f99a75'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/a4ed943882a8fc057ea5a67643314245e048bbdd'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/f310143961e2d9a0479fca117ce869f8aaecc140'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/fdfbaec5923d9359698cbb286bc0deadbb717504'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-58239.json
  - url: 'https://access.redhat.com/security/cve/CVE-2024-58239'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2390320'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2024-58239'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2024-58239'
  - url: >-
      https://lore.kernel.org/linux-cve-announce/2025082210-CVE-2024-58239-dd4f@gregkh/T
  - url: 'https://access.redhat.com/errata/RHSA-2024:9315'
tags:
  - nvd
  - exploit-available
  - csaf
  - vex
  - red-hat
  - cve.org
  - score-dispute
epss: 0.00358
epssPercentile: 0.29318
exploits:
  github: 2
  githubRepos:
    - 'https://github.com/khoatran107/cve-2024-58239'
    - 'https://github.com/khoatran107/cve-2025-39682'
  checkedAt: '2026-10-27T18:12:44.900Z'
exploitAvailable: true
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-10-15T21:42:29.347860Z'
scores:
  nvd: 8.2
  vendor: 5.9
  cna: 8.2
ingestedAt: '2026-10-15T22:48:25.465Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

tls: stop recv() if initial process_rx_list gave us non-DATA

If we have a non-DATA record on the rx_list and another record of the
same type still on the queue, we will end up merging them:
 - process_rx_list copies the non-DATA record
 - we start the loop and process the first available record since it's
   of the same type
 - we break out of the loop since the record was not DATA

Just check the record type and jump to the end in case process_rx_list
did some work.

## Affected

- `linux_kernel >= 5.1, < 5.4.270`
- `linux_kernel >= 5.5, < 5.10.211`
- `linux_kernel >= 5.11, < 5.15.150`
- `linux_kernel >= 5.16, < 6.1.80`
- `linux_kernel >= 6.2, < 6.6.19`
- `linux_kernel >= 6.7, < 6.7.7`
- `linux_kernel = 6.8`

## Remediation

Upgrade past the affected range:

- `linux_kernel 6.7.7`

## Vendor advisories

- **RHSA-2024:9315** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat CodeReady Linux Builder (v. 9), Red Hat Enterprise Linux Real Time for NFV (v. 9), Red Hat Enterprise Linux Real Time (v. 9) · released 2024-11-12 · [advisory](https://access.redhat.com/errata/RHSA-2024:9315)
- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9 · no fix planned: Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9 · updated 2026-10-16 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-58239.json)