{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2024-41066", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-07-12T12:17:45.630Z", "datePublished": "2024-07-29T14:57:27.832Z", "dateUpdated": "2026-08-05T11:35:08.968Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:35:08.968Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nibmvnic: Add tx check to prevent skb leak\n\nBelow is a summary of how the driver stores a reference to an skb during\ntransmit:\n tx_buff[free_map[consumer_index]]->skb = new_skb;\n free_map[consumer_index] = IBMVNIC_INVALID_MAP;\n consumer_index ++;\nWhere variable data looks like this:\n free_map == [4, IBMVNIC_INVALID_MAP, IBMVNIC_INVALID_MAP, 0, 3]\n \tconsumer_index^\n tx_buff == [skb=null, skb=, skb=, skb=null, skb=null]\n\nThe driver has checks to ensure that free_map[consumer_index] pointed to\na valid index but there was no check to ensure that this index pointed\nto an unused/null skb address. So, if, by some chance, our free_map and\ntx_buff lists become out of sync then we were previously risking an\nskb memory leak. This could then cause tcp congestion control to stop\nsending packets, eventually leading to ETIMEDOUT.\n\nTherefore, add a conditional to ensure that the skb address is null. If\nnot then warn the user (because this is still a bug that should be\npatched) and free the old pointer to prevent memleak/tcp problems." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:N - The vulnerable code is `ibmvnic_xmit()`, the transmit path exercised by every outbound packet, on the primary network interface of PowerVM LPARs that commonly serve internet-facing workloads. Unauthenticated remote traffic both induces the TX-watchdog reset that desyncs the pools and drives the subsequent leaking transmits, with no local access required.\nAC:L - An attacker saturating the interface can stall the TX queue and trip the watchdog (`ibmvnic_tx_timeout` → `VNIC_RESET_TIMEOUT`) while packets are in flight, creating the free_map/tx_buff desync, then continue sending to leak an skb on essentially every transmit that lands on an untracked slot. Once desynced the leak is deterministic, not probabilistic.\nPR:N - No credentials or account are needed — any remote peer that sends traffic eliciting responses reaches the transmit path. No capability check, authentication gate, or privileged interface sits between the attacker and the vulnerable code.\nUI:N - The leak occurs autonomously inside the driver's transmit path as packets are processed. No administrator or user action is required at any point.\nS:U - The leaked memory and the stalled TCP connections are all within the affected kernel's own security authority. Although the adapter is backed by a VIOS partition, nothing crosses into the VIOS, the hypervisor, or other LPARs.\nC:N - There is no out-of-bounds read, use-after-free, or uninitialized-memory exposure — the stale skb pointer is overwritten, never dereferenced. The DMA long-term buffer is zeroed with `memset(dst, 0, tx_pool->buf_size)` before every copy, so no residual kernel data can be emitted on the wire.\nI:N - No memory corruption, arbitrary write, or control-flow influence results; the defect is a dropped reference to a still-valid object. Nothing an attacker supplies modifies kernel data structures or stored data.\nA:H - Each leaked skb permanently pins the owning socket's `sk_wmem_alloc`, so congestion control halts transmission and connections fail with ETIMEDOUT, as the commit message states explicitly. Under sustained traffic this is unbounded kernel memory exhaustion combined with complete loss of network service on the affected system — not mere degradation." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/net/ethernet/ibm/ibmvnic.c" ], "versions": [ { "version": "65d6470d139a6c1655fccb5cbacbeaba8e8ad2f8", "lessThan": "16ad1557cae582e79bb82dddd612d9bdfaa11d4c", "status": "affected", "versionType": "git" }, { "version": "65d6470d139a6c1655fccb5cbacbeaba8e8ad2f8", "lessThan": "267c61c4afed0ff9a2e83462abad3f41d8ca1f06", "status": "affected", "versionType": "git" }, { "version": "65d6470d139a6c1655fccb5cbacbeaba8e8ad2f8", "lessThan": "e7b75def33eae61ddaad6cb616c517dc3882eb2a", "status": "affected", "versionType": "git" }, { "version": "65d6470d139a6c1655fccb5cbacbeaba8e8ad2f8", "lessThan": "0983d288caf984de0202c66641577b739caad561", "status": "affected", "versionType": "git" }, { "version": "1a64564eee05128f773930649edfdd50cbe80656", "status": "affected", "versionType": "git" }, { "version": "5142c39253385702a4de8f897027e1d76fc333de", "status": "affected", "versionType": "git" }, { "version": "5.12.17", "lessThan": "5.13", "status": "affected", "versionType": "semver" }, { "version": "5.13.2", "lessThan": "5.14", "status": "affected", "versionType": "semver" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/net/ethernet/ibm/ibmvnic.c" ], "versions": [ { "version": "5.14", "status": "affected" }, { "version": "0", "lessThan": "5.14", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.101", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.42", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.9.11", "lessThanOrEqual": "6.9.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.10", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.14", "versionEndExcluding": "6.1.101" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.14", "versionEndExcluding": "6.6.42" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.14", "versionEndExcluding": "6.9.11" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.14", "versionEndExcluding": "6.10" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.12.17" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13.2" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/16ad1557cae582e79bb82dddd612d9bdfaa11d4c" }, { "url": "https://git.kernel.org/stable/c/267c61c4afed0ff9a2e83462abad3f41d8ca1f06" }, { "url": "https://git.kernel.org/stable/c/e7b75def33eae61ddaad6cb616c517dc3882eb2a" }, { "url": "https://git.kernel.org/stable/c/0983d288caf984de0202c66641577b739caad561" } ], "title": "ibmvnic: Add tx check to prevent skb leak", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "title": "CVE Program Container", "references": [ { "url": "https://git.kernel.org/stable/c/16ad1557cae582e79bb82dddd612d9bdfaa11d4c", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/267c61c4afed0ff9a2e83462abad3f41d8ca1f06", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/e7b75def33eae61ddaad6cb616c517dc3882eb2a", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/0983d288caf984de0202c66641577b739caad561", "tags": [ "x_transferred" ] }, { "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html" } ], "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T22:00:16.258Z" } }, { "metrics": [ { "other": { "type": "ssvc", "content": { "id": "CVE-2024-41066", "role": "CISA Coordinator", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "version": "2.0.3", "timestamp": "2024-09-10T16:21:52.759335Z" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T17:32:57.523Z" } } ] } }