CVE-2024-49864

What it actually does

Race condition in rxrpc_open_socket allows UDP packet arrival in rxrpc_encap_rcv before I/O thread creation, triggering kernel oops on wake attempt; quick fix discards packets when no thread exists.

Why it matters to the business

May cause kernel crashes or denial of service on systems relying on rxrpc for network I/O, potentially disrupting communications with low exploitation likelihood given stable low EPSS and no KEV listing despite over 700 days since publication.

How an attack unfolds

An attacker sends a UDP packet targeting the rxrpc socket during the setup window before the I/O thread exists, causing the receiver to attempt waking a nonexistent thread and crash the kernel; listed threat actors reference unrelated kernel issues without direct tie to this race.

How to fix it

Apply kernel patch ensuring rxrpc_encap_rcv discards packets without an active I/O thread; upgrade to fixed kernel versions addressing the race (note listed actionview fixes appear mismatched to this Linux kernel issue).

How to confirm the fix worked

Confirm patch by reviewing rxrpc socket initialization sequence and testing packet reception during thread creation window; verify no oops in logs under load.

Typical attack path

1. Locate systems exposing rxrpc sockets over UDP
2. Send crafted packet precisely during socket initialization before I/O thread spawn
3. Trigger kernel oops leading to crash or instability

How to detect it

Search kernel logs for oops traces involving rxrpc_encap_rcv or failed thread wakeups; inspect UDP traffic timing around socket creation events on affected systems.

What your security team should do

• Prioritize kernel updates on systems using rxrpc protocol
• Monitor for kernel oops related to rxrpc_encap_rcv
• Review network exposure of affected Linux kernels given publication age and low EPSS