VYPR
← All advisories
Medium severity5.5NVD Advisory· Published Aug 17, 2024· Updated May 12, 2026

CVE-2024-42281

CVE-2024-42281

Description

In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix a segment issue when downgrading gso_size

Linearize the skb when downgrading gso_size because it may trigger a BUG_ON() later when the skb is segmented as described in [1,2].

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

In the Linux kernel, a BPF skb segmentation bug when downgrading gso_size can trigger a BUG_ON crash; patched in stable updates.

Vulnerability

In the Linux kernel, a bug in the BPF subsystem related to skb (socket buffer) segmentation can cause a kernel panic. When the kernel downgrades the GSO (Generic Segmentation Offload) size of an skb, it fails to linearize the buffer beforehand. This can later trigger a BUG_ON() during segmentation, as noted in the kernel commit message [1][2].

Exploitation

The vulnerability can be triggered by sending network packets that cause the kernel to reduce the GSO size of an skb. While the exact attack vector is not detailed, the bug is reachable from network input, potentially allowing a remote attacker to cause a denial of service by sending crafted packets. The Siemens advisory SSA-265688 lists this CVE among many affecting SIMATIC S7-1500 TM MFP devices with the GNU/Linux subsystem [1].

Impact

Successful exploitation leads to a kernel crash (BUG_ON), resulting in a denial of service. The CVSS v3 score is 5.5 (Medium), indicating a moderate availability impact with low attack complexity.

Mitigation

Patches have been applied to the Linux kernel stable trees, as seen in commits [2][3][4]. Users should update to kernel versions containing these fixes. For embedded products like Siemens SIMATIC S7-1500 TM MFP, users must apply firmware updates from Siemens that incorporate the patched kernel.

References
  1. SSA-265688
  2. Making sure you're not a bot!
  3. Making sure you're not a bot!
  4. Making sure you're not a bot!

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

121

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

10

News mentions

0

No linked articles in our index yet.