CVE-2024-50094

sfc: Don't invoke xdp_do_flush() from netpoll.

Description

In the Linux kernel, the following vulnerability has been resolved: sfc: Don't invoke xdp_do_flush() from netpoll. Yury reported a crash in the sfc driver originated from netpoll_send_udp(). The netconsole sends a message and then netpoll invokes the driver's NAPI function with a budget of zero. It is dedicated to allow driver to free TX resources, that it may have used while sending the packet. In the netpoll case the driver invokes xdp_do_flush() unconditionally, leading to crash because bpf_net_context was never assigned. Invoke xdp_do_flush() only if budget is not zero.

5.5

CVSS

Severity: Medium

CVSS 3.1 •

EPSS 0.03%

Affected: Linux Linux

References

Link	Tags
https://git.kernel.org/stable/c/65d4fc76d75c136744e67754d20feda609e7b793	patch
https://git.kernel.org/stable/c/55e802468e1d38dec8e25a2fdb6078d45b647e8c	patch

Frequently Asked Questions

What is the severity of CVE-2024-50094?: CVE-2024-50094 has been scored as a medium severity vulnerability.
How to fix CVE-2024-50094?: To fix CVE-2024-50094, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2024-50094 being actively exploited in the wild?: As for now, there are no information to confirm that CVE-2024-50094 is being actively exploited. According to its EPSS score, there is a ~0% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2024-50094?: CVE-2024-50094 affects Linux Linux, Linux Linux.

This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.