CVE-2024-47695
A critical vulnerability in the Linux kernel's RDMA component (CVE-2024-47695) allows out-of-bounds memory access during connection cleanup, potentially leading to system compromise. The issue arises from improper handling of connection IDs (cid) in the cleanup loop, which was resolved by adjusting cid to stay within valid bounds.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Systems using the Linux kernel (specifically the RDMA/rtrs-clt component)
Real-world impact
High risk of exploitation due to critical severity (CVSS 9.8) and potential for arbitrary code execution or system disruption.
Why this severity
CVSS 9.8 (Critical): High confidence in exploitability and severe impact on confidentiality, integrity, and availability.
What to do about it
- 01Upgrade the Linux kernel to a version that includes the fix for CVE-2024-47695 (as described in the NVD advisory).
- 02Apply the kernel patch manually if automatic updates are unavailable, following distribution-specific instructions.
NVD description of the vulnerability resolution in the Linux kernel
Timeline
- Oct 21, 2024 · Oct 21, 2024PublishedDisclosed and added to the National Vulnerability Database.
- Aug 4, 2026 · 2d agoAdvisory updatedThe NVD record was last revised.
- Aug 4, 2026 · 1d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.
How it’s attacked
References & advisories
- git.kernel.org/stable/c/01b9be936ee8839ab9…patch
- git.kernel.org/stable/c/0429a4e972082e3a23…patch
- git.kernel.org/stable/c/1c50e0265fa332c94a…patch
- git.kernel.org/stable/c/3e4289b29e216a55d0…patch
- git.kernel.org/stable/c/5ac73f8191f3de41fe…patch
- git.kernel.org/stable/c/c8b7f3d9fada0d4b4b…patch
- lists.debian.org/debian-lts-announce/2025/01…