CVE-2024-44935 is a vulnerability identified in the Linux kernel's SCTP (Stream Control Transmission Protocol) implementation, specifically related to the handling of sockets with the SO_REUSEPORT option. The flaw arises due to improper synchronization in the functions reuseport_alloc(), reuseport_add_sock(), and reuseport_detach_sock(), which manage socket reuseport groups. When two sockets concurrently call listen() on the same port with SO_REUSEPORT, and one socket is closed while the other is being added, a race condition can occur. This leads to multiple identical reuseport groups being created, with only one group actively receiving incoming packets, while others become silently dead. More critically, this race condition can cause a null pointer dereference in reuseport_add_sock() when accessing sk2->sk_reuseport_cb, which may have been cleared concurrently by reuseport_detach_sock() during socket closure. This null pointer dereference can trigger a kernel crash (general protection fault), leading to a denial of service (DoS) condition. The vulnerability was discovered by syzbot, a kernel fuzzing tool, and is documented with detailed kernel stack traces. The issue is unique to SCTP because TCP and UDP implementations hold a hash bucket lock preventing this race, which SCTP lacked prior to this fix. The patch involves applying a locking strategy to __sctp_hash_endpoint() and __sctp_unhash_endpoint() to ensure proper synchronization. This vulnerability affects Linux kernel versions prior to the fix applied around kernel version 6.10.0 and can be triggered by local processes creating and closing SCTP sockets with SO_REUSEPORT concurrently. There are no known exploits in the wild yet, and no CVSS score has been assigned at the time of publication.

For European organizations, the primary impact of CVE-2024-44935 is the potential for local denial of service on Linux systems using SCTP with SO_REUSEPORT enabled. This could disrupt critical services relying on SCTP, such as telecommunications infrastructure, signaling systems (e.g., SS7 over SCTP), and certain real-time applications. Organizations running Linux servers in telecom, financial services, or industrial control systems that utilize SCTP may experience unexpected kernel crashes, leading to service outages and operational disruption. Although exploitation requires local access and concurrent socket operations, the vulnerability could be leveraged by malicious insiders or compromised local accounts to degrade system availability. Given the widespread use of Linux in European data centers, cloud environments, and embedded systems, the vulnerability poses a tangible risk to service continuity. However, the lack of remote exploitability and the requirement for specific socket operations limit the scope of impact primarily to systems with SCTP usage and local threat actors. The vulnerability also highlights the importance of kernel-level synchronization in network protocol implementations, as improper locking can lead to stability issues affecting critical infrastructure.

European organizations should prioritize updating their Linux kernels to versions that include the patch fixing CVE-2024-44935, specifically kernels 6.10.0 and later or backported security updates provided by their Linux distribution vendors. For environments where immediate patching is not feasible, administrators should audit and restrict local user permissions to prevent untrusted users from creating or manipulating SCTP sockets with SO_REUSEPORT. Monitoring kernel logs for null pointer dereference crashes related to reuseport_add_sock() can help detect attempted exploitation or triggering of this vulnerability. Additionally, organizations should review their use of SCTP and SO_REUSEPORT options, disabling SO_REUSEPORT on SCTP sockets if not strictly necessary to reduce attack surface. Telecom and industrial control system operators should coordinate with their Linux vendors and infrastructure providers to ensure timely deployment of patches and validate system stability post-update. Implementing kernel lockdown features and enhanced access controls can further reduce the risk of local exploitation. Finally, integrating this vulnerability into incident response plans and vulnerability management workflows will ensure rapid detection and remediation.