VYPR
← All advisories
Medium severity5.5NVD Advisory· Published Oct 21, 2024· Updated May 12, 2026

CVE-2024-49948

CVE-2024-49948

Description

In the Linux kernel, the following vulnerability has been resolved:

net: add more sanity checks to qdisc_pkt_len_init()

One path takes care of SKB_GSO_DODGY, assuming skb->len is bigger than hdr_len.

virtio_net_hdr_to_skb() does not fully dissect TCP headers, it only make sure it is at least 20 bytes.

It is possible for an user to provide a malicious 'GSO' packet, total length of 80 bytes.

  • 20 bytes of IPv4 header
  • 60 bytes TCP header
  • a small gso_size like 8

virtio_net_hdr_to_skb() would declare this packet as a normal GSO packet, because it would see 40 bytes of payload, bigger than gso_size.

We need to make detect this case to not underflow qdisc_skb_cb(skb)->pkt_len.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

In the Linux kernel, a missing sanity check in qdisc_pkt_len_init() can cause an underflow when processing malicious GSO packets.

The vulnerability resides in the network subsystem of the Linux kernel, specifically in the qdisc_pkt_len_init() function. The issue arises because the code does not sufficiently validate GSO (Generic Segmentation Offload) packets that have been processed by virtio_net_hdr_to_skb(). This function only ensures the TCP header is at least 20 bytes, but does not fully dissect the header structure [Description].

An attacker could craft a malicious 'GSO' packet with a small total length (e.g., 80 bytes: 20-byte IPv4 header, 60-byte TCP header, and a small gso_size like 8). virtio_net_hdr_to_skb() would incorrectly classify this as a normal GSO packet because it sees more payload (40 bytes) than the gso_size. This bypasses the existing sanity checks that assume skb->len is larger than hdr_len [Description].

The lack of proper validation leads to an underflow of qdisc_skb_cb(skb)->pkt_len, which can cause kernel memory corruption or a denial-of-service condition [Description]. The CVSS v3.1 base score is 5.5 (Medium), with the attack vector being local, low privileges required, and the primary impact on availability [Header].

The fix was applied in the Linux kernel stable tree via commit 566a931a1436d0e0ad13708ea55479b95426213c, which adds additional sanity checks to detect and reject such malformed GSO packets [4]. Users are advised to update their kernel to a version containing this commit.

References
  1. Making sure you're not a bot!

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

80

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

14

News mentions

0

No linked articles in our index yet.