Unrated severityNVD Advisory· Published Nov 5, 2024· Updated Oct 1, 2025
sfc: Don't invoke xdp_do_flush() from netpoll.
CVE-2024-50094
Description
In the Linux kernel, the following vulnerability has been resolved:
sfc: Don't invoke xdp_do_flush() from netpoll.
Yury reported a crash in the sfc driver originated from netpoll_send_udp(). The netconsole sends a message and then netpoll invokes the driver's NAPI function with a budget of zero. It is dedicated to allow driver to free TX resources, that it may have used while sending the packet.
In the netpoll case the driver invokes xdp_do_flush() unconditionally, leading to crash because bpf_net_context was never assigned.
Invoke xdp_do_flush() only if budget is not zero.
Affected products
12- osv-coords10 versionspkg:deb/ubuntu/linux@6.11.0-18.18?arch=source&distro=oracularpkg:deb/ubuntu/linux-aws@6.11.0-1009.10?arch=source&distro=oracularpkg:deb/ubuntu/linux-azure@6.11.0-1009.9?arch=source&distro=oracularpkg:deb/ubuntu/linux-gcp@6.11.0-1009.9?arch=source&distro=oracularpkg:deb/ubuntu/linux-lowlatency@6.11.0-1010.11?arch=source&distro=oracularpkg:deb/ubuntu/linux-oracle@6.11.0-1011.12?arch=source&distro=oracularpkg:deb/ubuntu/linux-raspi@6.11.0-1008.8?arch=source&distro=oracularpkg:deb/ubuntu/linux-realtime@6.11.0-1005.5?arch=source&distro=oracularpkg:rpm/opensuse/kernel-source&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/kernel-source-longterm&distro=openSUSE%20Tumbleweed
< 6.11.0-18.18+ 9 more
- (no CPE)range: < 6.11.0-18.18
- (no CPE)range: < 6.11.0-1009.10
- (no CPE)range: < 6.11.0-1009.9
- (no CPE)range: < 6.11.0-1009.9
- (no CPE)range: < 6.11.0-1010.11
- (no CPE)range: < 6.11.0-1011.12
- (no CPE)range: < 6.11.0-1008.8
- (no CPE)range: < 6.11.0-1005.5
- (no CPE)range: < 6.11.8-1.1
- (no CPE)range: < 6.12.11-1.1
Patches
Vulnerability mechanics
References
2News mentions
0No linked articles in our index yet.