What is the CVSS score of CVE-2024-38384?

CVE-2024-38384 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Linux Kernel are affected by CVE-2024-38384?

CVE-2024-38384 is a memory corruption vulnerability in the Linux kernel's I/O cgroup accounting subsystem that permits local users to crash systems or corrupt kernel memory.. A patch is available.

How to fix or mitigate CVE-2024-38384?

Within 24 hours: Catalog all Linux systems to identify those running vulnerable kernel versions, prioritizing servers with active local user accounts. Within 7 days: Deploy the vendor-released patch to testing and staging environments to validate system stability and application compatibility across your infrastructure. Within 30 days: Roll out patched kernel versions to all affected production systems using scheduled maintenance windows, ensuring no vulnerable kernel versions remain in operation.

Linux Kernel CVE-2024-38384

HIGH

Uncontrolled Resource Consumption (CWE-400)

2024-06-24 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Denial Of Service Linux

7.8

CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.0 HIGH

Race condition demands precise concurrent I/O timing (AC:H); local low-privilege access required (AV:L/PR:L); kernel list corruption enables full system impact.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Aug 04, 2026 - 11:49 vuln.today

v2 (cvss_changed)

Analysis Updated

Aug 04, 2026 - 11:42 vuln.today

v1 (cvss_changed)

Re-analysis Queued

Aug 04, 2026 - 11:23 vuln.today

cvss_changed

CVSS changed

Aug 04, 2026 - 11:23 NVD

8.4 (HIGH) 7.8 (HIGH)

CVE Published

Jun 24, 2024 - 14:15 cve.org

HIGH 8.4

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

blk-cgroup: fix list corruption from reorder of WRITE ->lqueued

__blkcg_rstat_flush() can be run anytime, especially when blk_cgroup_bio_start is being executed.

If WRITE of ->lqueued is re-ordered with READ of 'bisc->lnode.next' in the loop of __blkcg_rstat_flush(), next_bisc can be assigned with one stat instance being added in blk_cgroup_bio_start(), then the local list in __blkcg_rstat_flush() could be corrupted.

Fix the issue by adding one barrier.

AnalysisAI

Memory ordering race condition in the Linux kernel's blk-cgroup I/O accounting subsystem allows a local low-privileged user to corrupt kernel linked-list structures, potentially causing a system crash or kernel memory corruption. The flaw arises when CPU instruction reordering causes __blkcg_rstat_flush() to read a stale or partially-initialized next_bisc pointer while blk_cgroup_bio_start() concurrently modifies the statistics list, resolved only by inserting a memory barrier. With a CVSS 7.8 score (AV:L/AC:L/PR:L) but a low EPSS of 0.24% at the 15th percentile, this is a genuine kernel integrity issue with no confirmed active exploitation and no known public proof-of-concept at time of analysis.

Technical ContextAI

The blk-cgroup subsystem implements per-cgroup block I/O accounting in the Linux kernel, tracking per-CPU statistics via linked lists of blkcg_iostat_cpu instances. The vulnerability is a classic memory ordering hazard: without a compiler and CPU memory barrier between the WRITE to ->lqueued in blk_cgroup_bio_start() and the READ of bisc->lnode.next in the flush loop of __blkcg_rstat_flush(), modern out-of-order CPUs (particularly on architectures with relaxed memory models like x86 with store-load reordering or ARM) can expose the flush routine to an incompletely-published list entry, assigning next_bisc a pointer to a structure still being initialized. The root cause is a synchronization omission (CWE-400 is assigned, though CWE-362 - Race Condition - more precisely describes the flaw class). The fix is a single barrier instruction. Three stable-tree commits were issued (714e59b5, 785298ab, d0aac236), implying the fix was backported across at least three active stable kernel series. Affected products span all Linux kernel versions in the CPE range cpe:2.3:o:linux:linux_kernel:*.

RemediationAI

Apply the upstream kernel patches available via the Linux stable git tree: commits 714e59b5456e4d6e4295a9968c564abe193f461c, 785298ab6b802afa75089239266b6bbea590809c, and d0aac2363549e12cc79b8e285f13d5a9f42fd08e (https://git.kernel.org/stable/). Users should update to the distribution-provided kernel package that incorporates these fixes; consult your vendor's security errata (Red Hat RHSA, Ubuntu USN, Debian DSA, SUSE SUSE-SU) for the specific patched kernel version for your distribution. Exact patched version numbers are not independently confirmed from the available input data beyond the upstream stable commits. As a compensating control pending patching, disabling cgroup v2 block I/O controllers (removing io.weight or io.max configuration from cgroup slices) would eliminate the vulnerable code path, at the trade-off of losing per-cgroup I/O throttling for containers or workloads. Restricting local user access on multi-tenant systems reduces exposure given the AV:L/PR:L exploitation requirement.