CVE-2024-50294

A flaw was found in the Linux kernel. A local user can cause a Denial of Service (DoS) due to missing locking in the RxRPC network protocol subsystem. When a queued client call is aborted before being processed, improper synchronization allows a race condition that can corrupt the pending call queue and cause connection requests to hang indefinitely.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this vulnerability on systems that do not use the in-kernel AFS filesystem or RxRPC protocol, prevent the rxrpc kernel module from loading:

1. Create a modprobe configuration file to disable autoloading:

echo "install rxrpc /bin/true" > /etc/modprobe.d/disable-rxrpc.conf

2. If the module is currently loaded, unload it:

modprobe -r rxrpc

Caveats: Disabling rxrpc prevents the use of the AF_RXRPC socket family and the in-kernel AFS client (kafs). If the module is currently in use and cannot be unloaded dynamically, a system reboot is required for the change to take full effect.