01 Record

CVE-2024-57996

net_sched: sch_sfq: don't allow 1 packet limit

HighPUBLISHEDCNA: Linux

CNA base score7.8 CVSS v3.xCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

View raw JSON

02 Description

net_sched: sch_sfq: don't allow 1 packet limit

03 Exploitation and scoring

Exploitation: Not assessed. CISA has not published an exploitation assessment for this record, and it is not in the KEV catalog. That is an absence of assessment, not a finding of no risk.
SSVC decision: Not assessed by CISA
EPSS probability: 0.27% probability of exploitation activity in the next 30 days.
EPSS percentile: Equal to or higher than the score of 19.4% of scored records. A rank, not a probability.
NVD base score: 5.5 (CVSS v3.x), scored by the NVD independently of the CNA.
NVD CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
NVD analysis status: Modified. NVD last modified this record on 2026-10-15.
Red Hat severity: Moderate. Red Hat's rating for its own products, not a CVSS rating.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

04 Metadata

Published

2025-02-27 02:07Z1 YR AGO

Last updated

2026-10-15 01:01Z14 DAYS AGO

Reserved

2025-02-27

Assigning CNA

Linux

Record state

PUBLISHED

Severity

High (CVSS 7.8)

CNA CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-129Improper Validation of Array IndexVariant

Data version

5.2

Document digest

f443e51598ef6119ba1f8fafb4dbdca4e9f849fe846bf8ee94b2f67f58a4a4fb

05 Affected products

VendorProductVersionsPlatforms

LinuxLinux1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < e12f6013d0a69660e8b99bfe381b9546ae667328, 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 1e6d9d87626cf89eeffb4d943db12cb5b10bf961, 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 1b562b7f9231432da40d12e19786c1bd7df653a7, 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 35d0137305ae2f97260a9047f445bd4434bd6cc7, 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 833e9a1c27b82024db7ff5038a51651f48f05e5e, 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 7d8947f2153ee9c5ab4cb17861a11cc45f30e8c4, 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 7fefc294204f10a3405f175f4ac2be16d63f135e, 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 10685681bafce6febb39770f3387621bf5d67d0b, 2.6.12—

06 References

git.kernel.orghttps://git.kernel.org/stable/c/e12f6013d0a69660e8b99bfe381b9546ae667328
git.kernel.orghttps://git.kernel.org/stable/c/1e6d9d87626cf89eeffb4d943db12cb5b10bf961
git.kernel.orghttps://git.kernel.org/stable/c/1b562b7f9231432da40d12e19786c1bd7df653a7
git.kernel.orghttps://git.kernel.org/stable/c/35d0137305ae2f97260a9047f445bd4434bd6cc7
git.kernel.orghttps://git.kernel.org/stable/c/833e9a1c27b82024db7ff5038a51651f48f05e5e
git.kernel.orghttps://git.kernel.org/stable/c/7d8947f2153ee9c5ab4cb17861a11cc45f30e8c4
git.kernel.orghttps://git.kernel.org/stable/c/7fefc294204f10a3405f175f4ac2be16d63f135e
git.kernel.orghttps://git.kernel.org/stable/c/10685681bafce6febb39770f3387621bf5d67d0b
lists.debian.orghttps://lists.debian.org/debian-lts-announce/2025/10/msg00007.html
lists.debian.orghttps://lists.debian.org/debian-lts-announce/2025/03/msg00028.html
cert-portal.siemens.comhttps://cert-portal.siemens.com/productcert/html/ssa-082556.html
cert-portal.siemens.comhttps://cert-portal.siemens.com/productcert/html/ssa-784472.html

07 Fixed in

Debian 12

linux
Fixed in 6.1.129-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 13

linux
Fixed in 6.12.13-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 14

linux
Fixed in 6.12.13-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.