CVE-2024-0646 Kernel: ktls overwrites readonly memory pages when using function splice with a ktls socket as destination

High 7.0 Published 17 Jan 2024 Updated 6 Aug 2026

A local attacker can exploit an out-of-bounds write in the Linux kernel's ktls splice function to crash the system or escalate privileges.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2024-0646?

CVE-2024-0646 is a high-severity memory corruption vulnerability in Linux kernel, published on 17 Jan 2024. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

An out-of-bounds memory write flaw was found in the Linux kernel’s Transport Layer Security functionality in how a user calls a function splice with a ktls socket as the destination. This flaw allows a local user to crash or potentially escalate their privileges on the system.

Weakness: CWE-787

Which versions are affected by CVE-2024-0646?

It affects 2 products.

Linux distribution packages (21)

`kpatch-patch-5_14_0-362_13_1` Red Hat:enterprise_linux:9::baseos	All versions	`0:1-2.el9_3`
`kpatch-patch-5_14_0-362_13_1-debuginfo` Red Hat:enterprise_linux:9::baseos	All versions	`0:1-2.el9_3`
`kpatch-patch-5_14_0-362_13_1-debugsource` Red Hat:enterprise_linux:9::baseos	All versions	`0:1-2.el9_3`
`kpatch-patch-5_14_0-362_18_1` Red Hat:enterprise_linux:9::baseos	All versions	`0:1-1.el9_3`
`kpatch-patch-5_14_0-362_18_1-debuginfo` Red Hat:enterprise_linux:9::baseos	All versions	`0:1-1.el9_3`
`kpatch-patch-5_14_0-362_18_1-debugsource` Red Hat:enterprise_linux:9::baseos	All versions	`0:1-1.el9_3`
`kpatch-patch-5_14_0-362_8_1` Red Hat:enterprise_linux:9::baseos	All versions	`0:1-3.el9_3`
`kpatch-patch-5_14_0-362_8_1-debuginfo` Red Hat:enterprise_linux:9::baseos	All versions	`0:1-3.el9_3`
`kpatch-patch-5_14_0-362_8_1-debugsource` Red Hat:enterprise_linux:9::baseos	All versions	`0:1-3.el9_3`
`kpatch-patch-5_14_0-284_25_1` Red Hat:rhel_eus:9.2::baseos	All versions	`0:1-6.el9_2`
`kpatch-patch-5_14_0-284_25_1-debuginfo` Red Hat:rhel_eus:9.2::baseos	All versions	`0:1-6.el9_2`
`kpatch-patch-5_14_0-284_25_1-debugsource` Red Hat:rhel_eus:9.2::baseos	All versions	`0:1-6.el9_2`
`kpatch-patch-5_14_0-284_30_1` Red Hat:rhel_eus:9.2::baseos	All versions	`0:1-3.el9_2`
`kpatch-patch-5_14_0-284_30_1-debuginfo` Red Hat:rhel_eus:9.2::baseos	All versions	`0:1-3.el9_2`
`kpatch-patch-5_14_0-284_30_1-debugsource` Red Hat:rhel_eus:9.2::baseos	All versions	`0:1-3.el9_2`
`kpatch-patch-5_14_0-284_40_1` Red Hat:rhel_eus:9.2::baseos	All versions	`0:1-2.el9_2`
`kpatch-patch-5_14_0-284_40_1-debuginfo` Red Hat:rhel_eus:9.2::baseos	All versions	`0:1-2.el9_2`
`kpatch-patch-5_14_0-284_40_1-debugsource` Red Hat:rhel_eus:9.2::baseos	All versions	`0:1-2.el9_2`
`kpatch-patch-5_14_0-284_48_1` Red Hat:rhel_eus:9.2::baseos	All versions	`0:1-1.el9_2`
`kpatch-patch-5_14_0-284_48_1-debuginfo` Red Hat:rhel_eus:9.2::baseos	All versions	`0:1-1.el9_2`
`kpatch-patch-5_14_0-284_48_1-debugsource` Red Hat:rhel_eus:9.2::baseos	All versions	`0:1-1.el9_2`

Products include Linux kernel, Redhat Enterprise Linux.

How do I fix CVE-2024-0646?

Apply the vendor's patch.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2024-0646 being exploited?

There is no known exploitation of CVE-2024-0646 in the wild and no public exploit code.

All Linux kernel vulnerabilities

Sources

Also known as AZL-33890, AZL-34873, BELL-CVE-2024-0646, DEBIAN-CVE-2024-0646, GHSA-qmff-49xc-7rf6, RHSA-2024:0850 and 2 more.