CVE-2024-0646 is a vulnerability in the Linux kernel's ktls implementation where an out-of-bounds write occurs when the splice function is used with a ktls socket as the destination. This flaw allows a local user to cause a denial of service (system crash) or potentially escalate privileges. Red Hat's advisories RHSA-2024:0723 and RHSA-2024:0724 confirm the issue and provide patches for Red Hat Enterprise Linux 9.2 and 8.6 Extended Update Support versions. The kernel update fixes the ktls overwrite of readonly memory pages. The system must be rebooted after applying the update for the fix to take effect.

The vulnerability allows a local user to crash the system or potentially escalate privileges due to an out-of-bounds memory write in the kernel's ktls code path. The CVSS 3.1 score is 7.0 (high severity) with impact on confidentiality, integrity, and availability. No known exploits in the wild have been reported at this time.

Red Hat has released official kernel updates addressing CVE-2024-0646 for Red Hat Enterprise Linux 8.6 and 9.2 Extended Update Support. Applying these updates and rebooting the system is required to remediate the vulnerability. Users should follow the guidance in Red Hat advisory articles (https://access.redhat.com/articles/11258) to apply the patches. No additional mitigations are indicated by the vendor.