CVE-2024-0646 is a high severity out-of-bounds write flaw in Linux Kernel kTLS, scored CVSS 7.0. The record lists Linux kernel builds and Red Hat Enterprise Linux 8.0. Apply your distribution kernel update. Use the steps below to confirm your exposure and plan the fix.
What's affected
The record lists Linux kernel builds and Red Hat Enterprise Linux 8.0. It involves calling splice with a kTLS socket as the destination.
A local user who calls splice with a kernel TLS socket as the destination can cause an out of bounds write, leading to a crash or privilege escalation.
The CVSS vector in the record is CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, with a base score of 7.0 (High). KEV status: not listed in the record.
Fixed version: Apply your distribution kernel update. Red Hat errata such as RHSA-2024:0723 are in the record references.
How to check if you're exposed
Print the running kernel and compare it with your distribution advisory.
uname -r
# Debian or Ubuntu
apt list --installed 2>/dev/null | grep linux-image
# RHEL, Fedora and derivatives
rpm -q kernel
rpm -q --changelog kernel | grep -i CVE-2024-0646
If the changelog or your vendor advisory lists the CVE as fixed in the installed build, you are covered. Containers share the host kernel, so check the host, not the image.
What to do now
- Identify hosts and virtual machines running affected kernels.
- Install the kernel update from your distribution and reboot, or use live patching if your vendor supports it for this CVE.
- Restrict local shell access and unprivileged features where the advisory suggests it, since the flaw needs a local user.
- Rescan after patching to confirm the finding closes.
Why it matters
CWE-787 describes this class. An out of bounds write stores data outside the memory a program was given. In the kernel that can corrupt other structures and lead to a crash or privilege escalation. Patches for this class usually add the missing bounds or state check.
The record does not mark this CVE as exploited in the wild, and it is not in the CISA KEV catalog. Published 2024-01-17.
For a wider view, a free in-browser dependency scan and the Gold directory show where Linux Kernel kTLS sits in your software, and reachability analysis helps separate code that can actually be hit from code that merely ships.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is CVE-2024-0646 exploited in the wild?
The record's KEV flag is false, and none of the pages I fetched said otherwise. That is not proof of safety, so still patch or restrict access.
Do containers need the kernel patch too?
Containers share the host kernel. Patch the host or node, not the container image.
Sources
- Safeguard Gold entry for CVE-2024-0646
- NVD record data for CVE-2024-0646, including the references listed there (the other reference pages were not fetched for this post).
Last reviewed: 19 October 2026.
