What is the CVSS score of CVE-2024-35999?

CVE-2024-35999 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

Which versions of Linux Kernel are affected by CVE-2024-35999?

The Linux kernel's SMB3 multichannel driver contains a data race condition in spinlock acquisition (CVE-2024-35999, CVSS 7.5) that could cause kernel panics and service interruption on systems…. A patch is available.

How to fix or mitigate CVE-2024-35999?

Within 24 hours, scan all systems to identify those running affected Linux kernel versions (stable branches through 6.9-rc5) that actively use SMB3 multichannel connections. Within 7 days, deploy the vendor-released kernel patch to a staging environment and validate that SMB3 multichannel file sharing continues to function without disruption. Within 30 days, roll out the patched kernel to all affected production systems during standard maintenance windows, beginning with non-critical infrastructure and progressing to production SMB3 servers.

Linux Kernel CVE-2024-35999

HIGH

Improper Locking (CWE-667)

2024-05-20 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Information Disclosure Linux

7.5

CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

5.9 MEDIUM

Race condition requires precise timing, so AC:H; no authentication needed on attacker-controlled server side; impact is availability only.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Updated

Aug 04, 2026 - 12:17 vuln.today

v2 (cvss_changed)

Analysis Updated

Aug 04, 2026 - 12:17 vuln.today

v1 (cvss_changed)

Re-analysis Queued

Aug 04, 2026 - 11:23 vuln.today

cvss_changed

Severity Changed

Aug 04, 2026 - 11:23 NVD

MEDIUM HIGH

CVSS changed

Aug 04, 2026 - 11:23 NVD

5.5 (MEDIUM) 7.5 (HIGH)

CVE Published

May 20, 2024 - 10:15 cve.org

MEDIUM 5.5

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

smb3: missing lock when picking channel

Coverity spotted a place where we should have been holding the channel lock when accessing the ses channel index.

Addresses-Coverity: 1582039 ("Data race condition (MISSING_LOCK)")

AnalysisAI

Missing spinlock acquisition in the Linux kernel's SMB3 multichannel driver exposes a data race condition when selecting network channels, potentially causing kernel panic or denial of service on affected systems using SMB3 multichannel connections. Affected versions span stable branches through Linux 6.9-rc5, with patches applied to multiple stable trees. No public exploit and no active exploitation confirmed; EPSS of 0.16% (6th percentile) reflects very low real-world exploitation probability, consistent with a race-condition-class flaw requiring precise timing.

Technical ContextAI

The SMB3 (Server Message Block 3) client driver in the Linux kernel supports multichannel connections (SMB3 multichannel / RDMA-capable channels) via a session channel list referenced by the ses structure. The driver must hold the channel lock before reading or modifying the channel index used to select which TCP connection to route I/O over. CWE-667 (Improper Locking) describes the root cause: concurrent kernel threads accessing shared channel state without synchronization, creating a classic TOCTOU data race. Coverity static analysis tool (report 1582039) identified this as a MISSING_LOCK defect. The CPE strings confirm the scope is the upstream Linux kernel itself (cpe:2.3:o:linux:linux_kernel:*) through the 6.9-rc1 through 6.9-rc5 release candidate series, as well as earlier stable branches addressed by the four stable-tree patches.

RemediationAI

Apply the upstream kernel patches available at the four stable-tree commits linked in the references section; distribution maintainers (Red Hat, Ubuntu, SUSE, Debian) will typically backport these to their respective kernels in point releases. Upgrade to a patched kernel version once your distribution releases it, or apply the commits directly if building from source. As a compensating control where patching is not immediately feasible, disabling SMB3 multichannel on the client (by setting 'max_channels=1' in the smb3 mount options or via /etc/samba/smb.conf 'client max channels = 1' for samba-based clients) eliminates the code path that triggers the race, at the cost of losing multichannel throughput benefits. If SMB3 shares are not required, unloading the cifs/smb3 kernel module (modprobe -r cifs) removes the attack surface entirely. No patch version number is independently confirmed beyond the upstream commit hashes.