{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2024-41046","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2024-07-12T12:17:45.625Z","datePublished":"2024-07-29T14:32:03.686Z","dateUpdated":"2026-08-05T11:34:58.198Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-05T11:34:58.198Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ethernet: lantiq_etop: fix double free in detach\n\nThe number of the currently released descriptor is never incremented\nwhich results in the same skb being released multiple times."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:A - The teardown path is reached via `ndo_tx_timeout`, which `dev_watchdog()` fires when the TX queue stays stopped for 10 s with carrier up — inducible by an attacker on the same Ethernet segment via sustained 802.3x PAUSE flooding or link-level stalling of the 100 Mbit MAC on these Lantiq CPE devices. The stall mechanism is link-local L2 and does not survive a router hop, so Adjacent rather than Network.\nAC:L - The attacker fully controls the stalling condition and can simply keep transmitting PAUSE frames past the 10-second watchdog window, and the buggy loop then unconditionally frees the same skb 192 times with no race or layout precondition. Heap grooming of the freed skb is also attacker-controlled since the same interface is receiving their traffic.\nPR:N - No account, credential, or authentication on the target is needed — an unauthenticated peer on the link segment only has to emit flow-control/traffic frames to trip the transmit watchdog. No local access or capability is involved on this path.\nUI:N - The watchdog timer fires automatically from `dev_watchdog()` and calls `ltq_etop_tx_timeout()` with no administrator or user action. No interface down/up, unbind, or module unload by a legitimate user is required.\nS:U - The double free corrupts kernel slab state within the same kernel security authority; no VM, hypervisor, IOMMU, or sandbox boundary is crossed.\nC:H - The 191 redundant frees operate on freed sk_buff memory, dereferencing `skb->head`/`skb->end` to reach `skb_shinfo()` and re-inserting the object into the skb slab freelist, producing overlapping allocations that let an attacker read reallocated kernel heap contents (other packets, credentials, kernel pointers). Per kernel guidance, use-after-free/double-free is scored High confidentiality.\nI:H - Freeing the same object 192 times corrupts the `skbuff_cache` freelist into aliased allocations (arbitrary write primitive) and drives an indirect call through the attacker-influenceable `skb->destructor` field in `skb_release_head_state()`, plus a controlled `skb->head` free and page refcount decrements. This is a control-flow-hijack-capable memory corruption, not a bounded modification.\nA:H - Even without exploitation the 191-fold double free reliably triggers slab corruption, list poisoning, and kernel panic/oops, and the DMA engine may still have the freed buffer mapped. The trigger is repeatable at will by the adjacent attacker."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/ethernet/lantiq_etop.c"],"versions":[{"version":"504d4721ee8e432af4b5f196a08af38bc4dac5fe","lessThan":"1a2db00a554cfda57c397cce79b2804bf9633fec","status":"affected","versionType":"git"},{"version":"504d4721ee8e432af4b5f196a08af38bc4dac5fe","lessThan":"907443174e76b854d28024bd079f0e53b94dc9a1","status":"affected","versionType":"git"},{"version":"504d4721ee8e432af4b5f196a08af38bc4dac5fe","lessThan":"22b16618a80858b3a9d607708444426948cc4ae1","status":"affected","versionType":"git"},{"version":"504d4721ee8e432af4b5f196a08af38bc4dac5fe","lessThan":"69ad5fa0ce7c548262e0770fc2b726fe7ab4f156","status":"affected","versionType":"git"},{"version":"504d4721ee8e432af4b5f196a08af38bc4dac5fe","lessThan":"c2b66e2b3939af63699e4a4bd25a8ac4a9b1d1b3","status":"affected","versionType":"git"},{"version":"504d4721ee8e432af4b5f196a08af38bc4dac5fe","lessThan":"9d23909ae041761cb2aa0c3cb1748598d8b6bc54","status":"affected","versionType":"git"},{"version":"504d4721ee8e432af4b5f196a08af38bc4dac5fe","lessThan":"84aaaa796a19195fc59290154fef9aeb1fba964f","status":"affected","versionType":"git"},{"version":"504d4721ee8e432af4b5f196a08af38bc4dac5fe","lessThan":"e1533b6319ab9c3a97dad314dd88b3783bc41b69","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/ethernet/lantiq_etop.c"],"versions":[{"version":"3.0","status":"affected"},{"version":"0","lessThan":"3.0","status":"unaffected","versionType":"semver"},{"version":"4.19.318","lessThanOrEqual":"4.19.*","status":"unaffected","versionType":"semver"},{"version":"5.4.280","lessThanOrEqual":"5.4.*","status":"unaffected","versionType":"semver"},{"version":"5.10.222","lessThanOrEqual":"5.10.*","status":"unaffected","versionType":"semver"},{"version":"5.15.163","lessThanOrEqual":"5.15.*","status":"unaffected","versionType":"semver"},{"version":"6.1.100","lessThanOrEqual":"6.1.*","status":"unaffected","versionType":"semver"},{"version":"6.6.41","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.9.10","lessThanOrEqual":"6.9.*","status":"unaffected","versionType":"semver"},{"version":"6.10","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.0","versionEndExcluding":"4.19.318"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.0","versionEndExcluding":"5.4.280"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.0","versionEndExcluding":"5.10.222"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.0","versionEndExcluding":"5.15.163"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.0","versionEndExcluding":"6.1.100"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.0","versionEndExcluding":"6.6.41"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.0","versionEndExcluding":"6.9.10"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.0","versionEndExcluding":"6.10"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/1a2db00a554cfda57c397cce79b2804bf9633fec"},{"url":"https://git.kernel.org/stable/c/907443174e76b854d28024bd079f0e53b94dc9a1"},{"url":"https://git.kernel.org/stable/c/22b16618a80858b3a9d607708444426948cc4ae1"},{"url":"https://git.kernel.org/stable/c/69ad5fa0ce7c548262e0770fc2b726fe7ab4f156"},{"url":"https://git.kernel.org/stable/c/c2b66e2b3939af63699e4a4bd25a8ac4a9b1d1b3"},{"url":"https://git.kernel.org/stable/c/9d23909ae041761cb2aa0c3cb1748598d8b6bc54"},{"url":"https://git.kernel.org/stable/c/84aaaa796a19195fc59290154fef9aeb1fba964f"},{"url":"https://git.kernel.org/stable/c/e1533b6319ab9c3a97dad314dd88b3783bc41b69"}],"title":"net: ethernet: lantiq_etop: fix double free in detach","x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://git.kernel.org/stable/c/1a2db00a554cfda57c397cce79b2804bf9633fec","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/907443174e76b854d28024bd079f0e53b94dc9a1","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/22b16618a80858b3a9d607708444426948cc4ae1","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/69ad5fa0ce7c548262e0770fc2b726fe7ab4f156","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/c2b66e2b3939af63699e4a4bd25a8ac4a9b1d1b3","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/9d23909ae041761cb2aa0c3cb1748598d8b6bc54","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/84aaaa796a19195fc59290154fef9aeb1fba964f","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/e1533b6319ab9c3a97dad314dd88b3783bc41b69","tags":["x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2025-11-03T21:59:45.501Z"}},{"metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2024-41046","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2024-09-10T16:22:57.535074Z"}}}],"title":"CISA ADP Vulnrichment","providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2024-09-11T17:34:02.313Z"}}]}}