VYPR
← All advisories
Medium severity5.5NVD Advisory· Published Oct 21, 2024· Updated May 12, 2026

CVE-2024-49973

CVE-2024-49973

Description

In the Linux kernel, the following vulnerability has been resolved:

r8169: add tally counter fields added with RTL8125

RTL8125 added fields to the tally counter, what may result in the chip dma'ing these new fields to unallocated memory. Therefore make sure that the allocated memory area is big enough to hold all of the tally counter values, even if we use only parts of it.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

In the Linux kernel's r8169 driver, RTL8125 tally counter fields are DMA'd to unallocated memory, risking data corruption.

Vulnerability

Overview

The r8169 Ethernet driver for Realtek network adapters has a memory allocation vulnerability affecting RTL8125 hardware. The hardware tally counter structure was extended with new fields, but the driver's DMA buffer allocation was not updated accordingly. This causes the chip to write tally counter data into memory beyond the allocated region, leading to an out-of-bounds write [3][4].

Exploitation

An attacker with local access and low privileges can trigger DMA operations by sending network traffic or through normal device usage. No additional authentication is required beyond local user privileges.

Impact

This memory corruption can result in system instability, including crashes or denial of service. The vulnerability is rated CVSS 5.5 (Medium) due to its local attack vector and potential for availability impact.

Mitigation

The fix requires updating the kernel to include commits that increase the allocation size to cover all tally counter fields. Linux distributions have released patches; users should install updates promptly.

References
  1. Making sure you're not a bot!
  2. Making sure you're not a bot!

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

105

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

12

News mentions

0

No linked articles in our index yet.