CVE-2024-41007

What it actually does

The flaw causes tcp_retransmit_timer() to retransmit packets every two jiffies for approximately four minutes after TCP_USER_TIMEOUT has expired when the peer window is zero, because tcp_rtx_probe0_timed_out() ignores icsk->icsk_user_timeout.

Why it matters to the business

Systems may experience elevated CPU and network usage from excessive retransmissions on TCP connections that use TCP_USER_TIMEOUT, potentially degrading performance in latency-sensitive or high-connection environments; low urgency given low EPSS and absence from KEV.

How an attack unfolds

A local attacker creates a TCP socket configured with TCP_USER_TIMEOUT, arranges for the remote peer to advertise a zero window, allows the user timeout to expire, and triggers repeated retransmission attempts that bypass the intended timeout logic.

How to fix it

Upgrade the Linux kernel to a version containing commit 7bb7670f92bfbd05fc41a8f9a8f358b7ffed65f4 or later; rebuild and deploy the updated kernel across affected distributions.

How to confirm the fix worked

Confirm the presence of the fix by inspecting the tcp_rtx_probe0_timed_out() function for inclusion of icsk->icsk_user_timeout checks, or verify that the running kernel is built from a tree that includes the referenced commit.

Typical attack path

1. Obtain local access on an affected Linux system
2. Open a TCP socket and enable the TCP_USER_TIMEOUT socket option
3. Force or wait for the remote peer to retract its receive window to zero
4. Allow the configured user timeout interval to pass while the kernel continues retransmitting

How to detect it

Examine kernel logs and TCP statistics for unusually high retransmission counts on sockets using TCP_USER_TIMEOUT; use tracing tools to observe tcp_retransmit_timer behavior after user timeout expiration.

What your security team should do

• Apply the kernel patch or updated packages as soon as vendor builds are available
• Review workloads that set TCP_USER_TIMEOUT and consider alternative timeout handling where feasible
• Monitor TCP retransmission statistics for anomalous spikes on production systems