{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2024-50162",
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"state": "PUBLISHED",
"assignerShortName": "Linux",
"dateReserved": "2024-10-21T19:36:19.961Z",
"datePublished": "2024-11-07T09:31:39.141Z",
"dateUpdated": "2026-08-05T11:42:11.597Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux",
"dateUpdated": "2026-08-05T11:42:11.597Z"
},
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: devmap: provide rxq after redirect\n\nrxq contains a pointer to the device from where\nthe redirect happened. Currently, the BPF program\nthat was executed after a redirect via BPF_MAP_TYPE_DEVMAP*\ndoes not have it set.\n\nThis is particularly bad since accessing ingress_ifindex, e.g.\n\nSEC(\"xdp\")\nint prog(struct xdp_md *pkt)\n{\n return bpf_redirect_map(&dev_redirect_map, 0, 0);\n}\n\nSEC(\"xdp/devmap\")\nint prog_after_redirect(struct xdp_md *pkt)\n{\n bpf_printk(\"ifindex %i\", pkt->ingress_ifindex);\n return XDP_PASS;\n}\n\ndepends on access to rxq, so a NULL pointer gets dereferenced:\n\n<1>[ 574.475170] BUG: kernel NULL pointer dereference, address: 0000000000000000\n<1>[ 574.475188] #PF: supervisor read access in kernel mode\n<1>[ 574.475194] #PF: error_code(0x0000) - not-present page\n<6>[ 574.475199] PGD 0 P4D 0\n<4>[ 574.475207] Oops: Oops: 0000 [#1] PREEMPT SMP NOPTI\n<4>[ 574.475217] CPU: 4 UID: 0 PID: 217 Comm: kworker/4:1 Not tainted 6.11.0-rc5-reduced-00859-g780801200300 #23\n<4>[ 574.475226] Hardware name: Intel(R) Client Systems NUC13ANHi7/NUC13ANBi7, BIOS ANRPL357.0026.2023.0314.1458 03/14/2023\n<4>[ 574.475231] Workqueue: mld mld_ifc_work\n<4>[ 574.475247] RIP: 0010:bpf_prog_5e13354d9cf5018a_prog_after_redirect+0x17/0x3c\n<4>[ 574.475257] Code: cc cc cc cc cc cc cc 80 00 00 00 cc cc cc cc cc cc cc cc f3 0f 1e fa 0f 1f 44 00 00 66 90 55 48 89 e5 f3 0f 1e fa 48 8b 57 20 <48> 8b 52 00 8b 92 e0 00 00 00 48 bf f8 a6 d5 c4 5d a0 ff ff be 0b\n<4>[ 574.475263] RSP: 0018:ffffa62440280c98 EFLAGS: 00010206\n<4>[ 574.475269] RAX: ffffa62440280cd8 RBX: 0000000000000001 RCX: 0000000000000000\n<4>[ 574.475274] RDX: 0000000000000000 RSI: ffffa62440549048 RDI: ffffa62440280ce0\n<4>[ 574.475278] RBP: ffffa62440280c98 R08: 0000000000000002 R09: 0000000000000001\n<4>[ 574.475281] R10: ffffa05dc8b98000 R11: ffffa05f577fca40 R12: ffffa05dcab24000\n<4>[ 574.475285] R13: ffffa62440280ce0 R14: ffffa62440549048 R15: ffffa62440549000\n<4>[ 574.475289] FS: 0000000000000000(0000) GS:ffffa05f4f700000(0000) knlGS:0000000000000000\n<4>[ 574.475294] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n<4>[ 574.475298] CR2: 0000000000000000 CR3: 000000025522e000 CR4: 0000000000f50ef0\n<4>[ 574.475303] PKRU: 55555554\n<4>[ 574.475306] Call Trace:\n<4>[ 574.475313] \n<4>[ 574.475318] ? __die+0x23/0x70\n<4>[ 574.475329] ? page_fault_oops+0x180/0x4c0\n<4>[ 574.475339] ? skb_pp_cow_data+0x34c/0x490\n<4>[ 574.475346] ? kmem_cache_free+0x257/0x280\n<4>[ 574.475357] ? exc_page_fault+0x67/0x150\n<4>[ 574.475368] ? asm_exc_page_fault+0x26/0x30\n<4>[ 574.475381] ? bpf_prog_5e13354d9cf5018a_prog_after_redirect+0x17/0x3c\n<4>[ 574.475386] bq_xmit_all+0x158/0x420\n<4>[ 574.475397] __dev_flush+0x30/0x90\n<4>[ 574.475407] veth_poll+0x216/0x250 [veth]\n<4>[ 574.475421] __napi_poll+0x28/0x1c0\n<4>[ 574.475430] net_rx_action+0x32d/0x3a0\n<4>[ 574.475441] handle_softirqs+0xcb/0x2c0\n<4>[ 574.475451] do_softirq+0x40/0x60\n<4>[ 574.475458] \n<4>[ 574.475461] \n<4>[ 574.475464] __local_bh_enable_ip+0x66/0x70\n<4>[ 574.475471] __dev_queue_xmit+0x268/0xe40\n<4>[ 574.475480] ? selinux_ip_postroute+0x213/0x420\n<4>[ 574.475491] ? alloc_skb_with_frags+0x4a/0x1d0\n<4>[ 574.475502] ip6_finish_output2+0x2be/0x640\n<4>[ 574.475512] ? nf_hook_slow+0x42/0xf0\n<4>[ 574.475521] ip6_finish_output+0x194/0x300\n<4>[ 574.475529] ? __pfx_ip6_finish_output+0x10/0x10\n<4>[ 574.475538] mld_sendpack+0x17c/0x240\n<4>[ 574.475548] mld_ifc_work+0x192/0x410\n<4>[ 574.475557] process_one_work+0x15d/0x380\n<4>[ 574.475566] worker_thread+0x29d/0x3a0\n<4>[ 574.475573] ? __pfx_worker_thread+0x10/0x10\n<4>[ 574.475580] ? __pfx_worker_thread+0x10/0x10\n<4>[ 574.475587] kthread+0xcd/0x100\n<4>[ 574.475597] ? __pfx_kthread+0x10/0x10\n<4>[ 574.475606] ret_from_fork+0x31/0x50\n<4>[ 574.475615] ? __pfx_kthread+0x10/0x10\n<4>[ 574.475623] ret_from_fork_asm+0x1a/0x\n---truncated---"
}
],
"metrics": [
{
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 9.8,
"baseSeverity": "CRITICAL"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The uninitialized `xdp.rxq` is consumed in the XDP fast path during packet receive — `net_rx_action → __napi_poll → veth_poll → __dev_flush → bq_xmit_all → dev_map_bpf_prog_run` — so remote frames arriving at an XDP-enabled router, load balancer or container host drive the faulting code. This matches the repo's treatment of sibling XDP-redirect data-path bugs (CVE-2025-38246, CVE-2025-68341, CVE-2024-57932), all scored AV:N.\nAC:L - On an affected configuration every redirected frame deterministically dereferences the stale stack pointer; no race, timing window, or memory-layout condition must be won. For the multi-buffer variant the attacker simply sends an oversized frame to reach `bpf_xdp_frags_increase_tail()`/`bpf_xdp_shrink_data()`.\nPR:N - The attacker only has to put frames on the wire — no credentials, account, or authentication on the target are involved, and the fault occurs in softirq before any user context. The CAP_BPF/CAP_NET_ADMIN needed to attach XDP and populate the devmap is the victim's own legitimate configuration of a documented UAPI field, equivalent to enabling a network service, not a step the attacker performs.\nUI:N - Processing happens entirely in NAPI/softirq on frame arrival with no local user involved; the reported oops occurred against background MLD traffic. No victim action is required at attack time.\nS:U - The wild read, the mis-sized `memset()`, and the type-confused page free all occur in kernel memory on the same host, within a single security authority. No hypervisor, IOMMU, or sandbox boundary is crossed.\nC:H - `xdp.rxq` holds stale softirq-stack data that is dereferenced as a `struct xdp_rxq_info *`, so `ingress_ifindex` (`rxq->dev->ifindex`), `rx_queue_index` (`rxq->queue_index`), `rxq->frag_size` and `rxq->mem` are read from an arbitrary kernel address and returned into the BPF program, which can export them to userspace via maps or the perf ring. That is an unbounded kernel memory disclosure primitive.\nI:H - `bpf_xdp_frags_increase_tail()` derives `tailroom` from the garbage `rxq->frag_size`, which can underflow and defeat the `offset > tailroom` bound on the following `memset()`, giving a heap out-of-bounds write past the page fragment. `bpf_xdp_shrink_data()` additionally passes a garbage `xdp_mem_info` into `__xdp_return()`, causing a type-confused free across page_pool / page_frag / put_page / xsk_buff_free — the standard basis for heap corruption and privilege escalation.\nA:H - The commit documents a reproducible `BUG: kernel NULL pointer dereference` oops in softirq context (`bq_xmit_all+0x158`), and a non-zero stale pointer yields an equally fatal wild-address fault or corrupted-free panic. Either way the machine oopses on ordinary inbound traffic, a full denial of service."
}
]
}
],
"affected": [
{
"product": "Linux",
"vendor": "Linux",
"defaultStatus": "unaffected",
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"programFiles": [
"kernel/bpf/devmap.c"
],
"versions": [
{
"version": "cb261b594b4108668e00f565184c7c221efe0359",
"lessThan": "fe068afb868660fe683a8391c6c17ecbe2254922",
"status": "affected",
"versionType": "git"
},
{
"version": "cb261b594b4108668e00f565184c7c221efe0359",
"lessThan": "a778fbe087c19f4ece5f5fc14173328f070c3803",
"status": "affected",
"versionType": "git"
},
{
"version": "cb261b594b4108668e00f565184c7c221efe0359",
"lessThan": "49454f09936a9a96edfb047156889879cb4001eb",
"status": "affected",
"versionType": "git"
},
{
"version": "cb261b594b4108668e00f565184c7c221efe0359",
"lessThan": "9167d1c274a336e4763eeb3f3f9cb763c55df5aa",
"status": "affected",
"versionType": "git"
},
{
"version": "cb261b594b4108668e00f565184c7c221efe0359",
"lessThan": "ca9984c5f0ab3690d98b13937b2485a978c8dd73",
"status": "affected",
"versionType": "git"
}
]
},
{
"product": "Linux",
"vendor": "Linux",
"defaultStatus": "affected",
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"programFiles": [
"kernel/bpf/devmap.c"
],
"versions": [
{
"version": "5.14",
"status": "affected"
},
{
"version": "0",
"lessThan": "5.14",
"status": "unaffected",
"versionType": "semver"
},
{
"version": "5.15.170",
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"versionType": "semver"
},
{
"version": "6.1.115",
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"versionType": "semver"
},
{
"version": "6.6.59",
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"versionType": "semver"
},
{
"version": "6.11.6",
"lessThanOrEqual": "6.11.*",
"status": "unaffected",
"versionType": "semver"
},
{
"version": "6.12",
"lessThanOrEqual": "*",
"status": "unaffected",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.14",
"versionEndExcluding": "5.15.170"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.14",
"versionEndExcluding": "6.1.115"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.14",
"versionEndExcluding": "6.6.59"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.14",
"versionEndExcluding": "6.11.6"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.14",
"versionEndExcluding": "6.12"
}
]
}
]
}
],
"references": [
{
"url": "https://git.kernel.org/stable/c/fe068afb868660fe683a8391c6c17ecbe2254922"
},
{
"url": "https://git.kernel.org/stable/c/a778fbe087c19f4ece5f5fc14173328f070c3803"
},
{
"url": "https://git.kernel.org/stable/c/49454f09936a9a96edfb047156889879cb4001eb"
},
{
"url": "https://git.kernel.org/stable/c/9167d1c274a336e4763eeb3f3f9cb763c55df5aa"
},
{
"url": "https://git.kernel.org/stable/c/ca9984c5f0ab3690d98b13937b2485a978c8dd73"
}
],
"title": "bpf: devmap: provide rxq after redirect",
"x_generator": {
"engine": "bippy-1.2.0"
}
},
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 5.5,
"attackVector": "LOCAL",
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"integrityImpact": "NONE",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "LOW",
"confidentialityImpact": "NONE"
}
},
{
"other": {
"type": "ssvc",
"content": {
"id": "CVE-2024-50162",
"role": "CISA Coordinator",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"version": "2.0.3",
"timestamp": "2025-10-01T20:20:12.685878Z"
}
}
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"type": "CWE",
"description": "CWE-noinfo Not enough information"
}
]
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2025-10-01T20:27:12.062Z"
}
},
{
"title": "CVE Program Container",
"references": [
{
"url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
}
],
"providerMetadata": {
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE",
"dateUpdated": "2025-11-03T22:26:19.094Z"
}
}
]
}
}