{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2024-50094","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2024-10-21T19:36:19.943Z","datePublished":"2024-11-05T17:04:57.299Z","dateUpdated":"2026-08-05T11:41:37.056Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-05T11:41:37.056Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nsfc: Don't invoke xdp_do_flush() from netpoll.\n\nYury reported a crash in the sfc driver originated from\nnetpoll_send_udp(). The netconsole sends a message and then netpoll\ninvokes the driver's NAPI function with a budget of zero. It is\ndedicated to allow driver to free TX resources, that it may have used\nwhile sending the packet.\n\nIn the netpoll case the driver invokes xdp_do_flush() unconditionally,\nleading to crash because bpf_net_context was never assigned.\n\nInvoke xdp_do_flush() only if budget is not zero."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:N - The crash is reached through the netpoll/netconsole transmit path on the sfc NIC, and an unauthenticated remote attacker can drive both required conditions with packets alone — flood-induced rate-limited kernel log lines (SYN-flood/martian-source/conntrack-full messages) supply the printk, and the same flood supplies the TX-queue contention that forces `__netpoll_send_skb()` into the `netpoll_poll_dev()` retry loop.\nAC:L - Once netconsole is active on an sfc interface, every entry into `netpoll_poll_dev()` crashes deterministically — there is no race, no memory-layout dependency, and no timing window, and the attacker creates the TX contention that forces that entry by sustaining traffic.\nPR:N - No authentication or credential of any kind is checked along the path; the trigger is an ordinary kernel log message being shipped by netconsole, and the remote packets that induce those messages are processed pre-authentication by the TCP/IP stack.\nUI:N - No victim action is needed — netconsole emits on every printk automatically, so the attacker's own traffic completes the trigger without any local user or administrator doing anything.\nS:U - The faulting read and its consequences are confined to the kernel of the affected host; no VM, IOMMU, or sandbox boundary is crossed.\nC:N - The defect is a read of a NULL pointer at a fixed small offset whose result is never returned to or observable by the attacker; nothing is disclosed.\nI:N - No write occurs and no attacker-controlled data is stored — the faulting access is a load, so no kernel state is modified.\nA:H - The NULL dereference occurs in netpoll/console context with interrupts disabled, producing a kernel oops that is generally fatal, and it re-fires on every subsequent log message, so the host is reliably taken down."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/ethernet/sfc/efx_channels.c","drivers/net/ethernet/sfc/siena/efx_channels.c"],"versions":[{"version":"401cb7dae8130fd34eb84648e02ab4c506df7d5e","lessThan":"65d4fc76d75c136744e67754d20feda609e7b793","status":"affected","versionType":"git"},{"version":"401cb7dae8130fd34eb84648e02ab4c506df7d5e","lessThan":"55e802468e1d38dec8e25a2fdb6078d45b647e8c","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/ethernet/sfc/efx_channels.c","drivers/net/ethernet/sfc/siena/efx_channels.c"],"versions":[{"version":"6.11","status":"affected"},{"version":"0","lessThan":"6.11","status":"unaffected","versionType":"semver"},{"version":"6.11.4","lessThanOrEqual":"6.11.*","status":"unaffected","versionType":"semver"},{"version":"6.12","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.11","versionEndExcluding":"6.11.4"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.11","versionEndExcluding":"6.12"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/65d4fc76d75c136744e67754d20feda609e7b793"},{"url":"https://git.kernel.org/stable/c/55e802468e1d38dec8e25a2fdb6078d45b647e8c"}],"title":"sfc: Don't invoke xdp_do_flush() from netpoll.","x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.5,"attackVector":"LOCAL","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"NONE"}},{"other":{"type":"ssvc","content":{"id":"CVE-2024-50094","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2025-10-01T20:22:55.627667Z"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","description":"CWE-noinfo Not enough information"}]}],"title":"CISA ADP Vulnrichment","providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2025-10-01T20:27:19.526Z"}}]}}