CVE-2024-56632

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2024-56632", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-12-27T15:00:39.838Z", "datePublished": "2024-12-27T15:02:30.396Z", "dateUpdated": "2026-08-05T11:45:35.735Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:45:35.735Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvme-tcp: fix the memleak while create new ctrl failed\n\nNow while we create new ctrl failed, we have not free the\ntagset occupied by admin_q, here try to fix it."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:N - The leak path is selected entirely by data received from the remote NVMe-over-TCP target \u2014 `icdoff` and `sgls` are copied verbatim from the peer's Identify Controller response, and I/O-queue connect failures are equally peer-controlled. A rogue or MITM'd target on the network triggers the bug in the host kernel's nvme-tcp initiator.\nAC:L - A malicious target simply returns a non-zero `icdoff` or clears the SGL support bits, hitting `goto destroy_admin` on every single connection attempt with 100% reliability. No race, no memory-layout dependency, no timing window.\nPR:N - NVMe/TCP is unauthenticated by default (no TLS or DH-HMAC-CHAP unless explicitly configured), so the attacking target holds no credentials on the victim host. The failure is forced during Identify processing, before any host-side trust decision about the target.\nUI:N - In standard NVMe-oF deployments the nvme-cli discovery-log-change udev rule / nvmf-autoconnect service re-runs `nvme connect-all` automatically, so a malicious discovery controller can drive an unbounded stream of controller creations by advertising many subsystems and re-issuing AENs, with no administrator action per attempt.\nS:U - The leaked tag set, request queues and the resulting exhaustion are all confined to the kernel of the affected host; no privilege or virtualization boundary is crossed.\nC:N - The failure path leaks allocations but does not copy any kernel data toward the attacker or expose freed contents to the peer; no attacker-readable information disclosure results.\nI:N - Nothing attacker-controlled is written into kernel structures by the defect itself \u2014 the missing `nvme_remove_admin_tag_set()` only omits frees, leaving no write primitive to the remote peer.\nA:H - The leak is unbounded and remotely repeatable, so a hostile target can drive the host into kernel memory exhaustion and OOM; additionally the leaked hctxs stay registered on the blk-mq CPU-hotplug lists while their `tag_set` lives in the freed `nvme_tcp_ctrl`, so `blk_mq_map_queue_type()` dereferences freed memory on the next CPU offline/online and oopses the machine."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/nvme/host/tcp.c"], "versions": [{"version": "fd1418de10b9ca03d78404cf00a95138689ea369", "lessThan": "ceff9ac13a2478afddce85414d404e6aff6425f6", "status": "affected", "versionType": "git"}, {"version": "fd1418de10b9ca03d78404cf00a95138689ea369", "lessThan": "fec55c29e54d3ca6fe9d7d7d9266098b4514fd34", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/nvme/host/tcp.c"], "versions": [{"version": "6.7", "status": "affected"}, {"version": "0", "lessThan": "6.7", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.5", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.13", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.7", "versionEndExcluding": "6.12.5"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.7", "versionEndExcluding": "6.13"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/ceff9ac13a2478afddce85414d404e6aff6425f6"}, {"url": "https://git.kernel.org/stable/c/fec55c29e54d3ca6fe9d7d7d9266098b4514fd34"}], "title": "nvme-tcp: fix the memleak while create new ctrl failed", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-56632", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-01T20:00:42.380071Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-401", "description": "CWE-401 Missing Release of Memory after Effective Lifetime"}]}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-01T20:07:12.162Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-56632", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-01T20:00:42.380071Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-401", "description": "CWE-401 Missing Release of Memory after Effective Lifetime"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-01T15:44:05.924Z"}}], "cna": {"title": "nvme-tcp: fix the memleak while create new ctrl failed", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}, "scenarios": [{"lang": "en", "value": "AV:N - The leak path is selected entirely by data received from the remote NVMe-over-TCP target \u2014 `icdoff` and `sgls` are copied verbatim from the peer's Identify Controller response, and I/O-queue connect failures are equally peer-controlled. A rogue or MITM'd target on the network triggers the bug in the host kernel's nvme-tcp initiator.\nAC:L - A malicious target simply returns a non-zero `icdoff` or clears the SGL support bits, hitting `goto destroy_admin` on every single connection attempt with 100% reliability. No race, no memory-layout dependency, no timing window.\nPR:N - NVMe/TCP is unauthenticated by default (no TLS or DH-HMAC-CHAP unless explicitly configured), so the attacking target holds no credentials on the victim host. The failure is forced during Identify processing, before any host-side trust decision about the target.\nUI:N - In standard NVMe-oF deployments the nvme-cli discovery-log-change udev rule / nvmf-autoconnect service re-runs `nvme connect-all` automatically, so a malicious discovery controller can drive an unbounded stream of controller creations by advertising many subsystems and re-issuing AENs, with no administrator action per attempt.\nS:U - The leaked tag set, request queues and the resulting exhaustion are all confined to the kernel of the affected host; no privilege or virtualization boundary is crossed.\nC:N - The failure path leaks allocations but does not copy any kernel data toward the attacker or expose freed contents to the peer; no attacker-readable information disclosure results.\nI:N - Nothing attacker-controlled is written into kernel structures by the defect itself \u2014 the missing `nvme_remove_admin_tag_set()` only omits frees, leaving no write primitive to the remote peer.\nA:H - The leak is unbounded and remotely repeatable, so a hostile target can drive the host into kernel memory exhaustion and OOM; additionally the leaked hctxs stay registered on the blk-mq CPU-hotplug lists while their `tag_set` lives in the freed `nvme_tcp_ctrl`, so `blk_mq_map_queue_type()` dereferences freed memory on the next CPU offline/online and oopses the machine."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "fd1418de10b9ca03d78404cf00a95138689ea369", "lessThan": "ceff9ac13a2478afddce85414d404e6aff6425f6", "versionType": "git"}, {"status": "affected", "version": "fd1418de10b9ca03d78404cf00a95138689ea369", "lessThan": "fec55c29e54d3ca6fe9d7d7d9266098b4514fd34", "versionType": "git"}], "programFiles": ["drivers/nvme/host/tcp.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.7"}, {"status": "unaffected", "version": "0", "lessThan": "6.7", "versionType": "semver"}, {"status": "unaffected", "version": "6.12.5", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.13", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/nvme/host/tcp.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/ceff9ac13a2478afddce85414d404e6aff6425f6"}, {"url": "https://git.kernel.org/stable/c/fec55c29e54d3ca6fe9d7d7d9266098b4514fd34"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvme-tcp: fix the memleak while create new ctrl failed\n\nNow while we create new ctrl failed, we have not free the\ntagset occupied by admin_q, here try to fix it."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.5", "versionStartIncluding": "6.7"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.13", "versionStartIncluding": "6.7"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:45:35.735Z"}}}, "cveMetadata": {"cveId": "CVE-2024-56632", "state": "PUBLISHED", "dateUpdated": "2026-08-05T11:45:35.735Z", "dateReserved": "2024-12-27T15:00:39.838Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-12-27T15:02:30.396Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/nvme/host/tcp.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "ceff9ac13a2478afddce85414d404e6aff6425f6", "status": "affected", "version": "fd1418de10b9ca03d78404cf00a95138689ea369", "versionType": "git"}, {"lessThan": "fec55c29e54d3ca6fe9d7d7d9266098b4514fd34", "status": "affected", "version": "fd1418de10b9ca03d78404cf00a95138689ea369", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/nvme/host/tcp.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.7"}, {"lessThan": "6.7", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.5", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.13", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "9501D045-7A94-42CA-8B03-821BE94A65B7", "versionEndExcluding": "6.12.5", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.13:rc1:*:*:*:*:*:*", "matchCriteriaId": "62567B3C-6CEE-46D0-BC2E-B3717FBF7D13", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvme-tcp: fix the memleak while create new ctrl failed\n\nNow while we create new ctrl failed, we have not free the\ntagset occupied by admin_q, here try to fix it."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: nvme-tcp: corrige la fuga de memoria cuando falla la creaci\u00f3n de un nuevo control Ahora, aunque falla la creaci\u00f3n de un nuevo control, no hemos liberado el conjunto de etiquetas ocupado por admin_q, aqu\u00ed intentamos solucionarlo."}], "id": "CVE-2024-56632", "lastModified": "2026-08-04T11:22:15.773", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-56632", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-10-01T20:00:42.380071Z", "version": "2.0.3"}}]}, "published": "2024-12-27T15:15:22.803", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/ceff9ac13a2478afddce85414d404e6aff6425f6"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/fec55c29e54d3ca6fe9d7d7d9266098b4514fd34"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-401"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-401"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"bugzilla": {"description": "kernel: nvme-tcp: fix the memleak while create new ctrl failed", "id": "2334568", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2334568"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.1", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L", "status": "draft"}, "cwe": "CWE-401", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nnvme-tcp: fix the memleak while create new ctrl failed\nNow while we create new ctrl failed, we have not free the\ntagset occupied by admin_q, here try to fix it."], "name": "CVE-2024-56632", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-12-27T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-56632\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-56632\nhttps://lore.kernel.org/linux-cve-announce/2024122733-CVE-2024-56632-ea20@gregkh/T"], "threat_severity": "Low"}

{}