{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2024-50297", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-10-21T19:36:19.986Z", "datePublished": "2024-11-19T01:30:44.680Z", "dateUpdated": "2026-08-05T11:43:11.176Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:43:11.176Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: xilinx: axienet: Enqueue Tx packets in dql before dmaengine starts\n\nEnqueue packets in dql after dma engine starts causes race condition.\nTx transfer starts once dma engine is started and may execute dql dequeue\nin completion before it gets queued. It results in following kernel crash\nwhile running iperf stress test:\n\nkernel BUG at lib/dynamic_queue_limits.c:99!\n\nInternal error: Oops - BUG: 00000000f2000800 [#1] SMP\npc : dql_completed+0x238/0x248\nlr : dql_completed+0x3c/0x248\n\nCall trace:\n dql_completed+0x238/0x248\n axienet_dma_tx_cb+0xa0/0x170\n xilinx_dma_do_tasklet+0xdc/0x290\n tasklet_action_common+0xf8/0x11c\n tasklet_action+0x30/0x3c\n handle_softirqs+0xf8/0x230\n\n\nStart dmaengine after enqueue in dql fixes the crash." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:N - The vulnerable code is the NIC's `ndo_start_xmit` handler, driven directly by a remote peer's traffic — TCP ACKs, SYN-ACKs, and ICMP echo replies generated in response to a remote flood exercise this path at line rate, which is exactly the iperf stress condition that produced the reported panic. No local access is needed; a routed, internet-facing attacker suffices.\nAC:L - The attacker controls the enqueue side of the race and its packet rate, and can sustain traffic indefinitely until the DMA completion tasklet lands in the window between `dma_async_issue_pending()` and `netdev_tx_sent_queue()`; the bug was reproduced by an ordinary stress test on stock multi-core hardware.\nPR:N - Transmission is triggered by unauthenticated inbound packets, so no credentials or privileges of any kind are required; even in the local attacker model, any unprivileged socket send reaches the path with no capability check.\nUI:N - No victim action is needed — the target transmits automatically in response to attacker-supplied network traffic.\nS:U - The fault and its impact are confined to the kernel of the affected host; no VM, IOMMU, or sandbox boundary is crossed.\nC:N - The `BUG_ON` in `dql_completed()` fires before any accounting underflow or memory access occurs; the skb pointer and sg_len are assigned prior to DMA submission, so there is no out-of-bounds read, no UAF, and no information disclosure.\nI:N - The race corrupts nothing — the BQL consistency assertion aborts execution before the counters go inconsistent, giving the attacker no write primitive or data modification.\nA:H - `BUG_ON` is hit inside the DMA completion tasklet (softirq context), making it a fatal exception in interrupt context and a full kernel panic; on the embedded/appliance platforms this driver targets that means a hang requiring power-cycle, repeatable at will by an unauthenticated remote flood." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/net/ethernet/xilinx/xilinx_axienet_main.c" ], "versions": [ { "version": "6a91b846af85a24241decd686269e8e038eb13d1", "lessThan": "def3dee25cbd1c9b2ed443c3f6180e952563de77", "status": "affected", "versionType": "git" }, { "version": "6a91b846af85a24241decd686269e8e038eb13d1", "lessThan": "5ccdcdf186aec6b9111845fd37e1757e9b413e2f", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/net/ethernet/xilinx/xilinx_axienet_main.c" ], "versions": [ { "version": "6.8", "status": "affected" }, { "version": "0", "lessThan": "6.8", "status": "unaffected", "versionType": "semver" }, { "version": "6.11.8", "lessThanOrEqual": "6.11.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.8", "versionEndExcluding": "6.11.8" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.8", "versionEndExcluding": "6.12" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/def3dee25cbd1c9b2ed443c3f6180e952563de77" }, { "url": "https://git.kernel.org/stable/c/5ccdcdf186aec6b9111845fd37e1757e9b413e2f" } ], "title": "net: xilinx: axienet: Enqueue Tx packets in dql before dmaengine starts", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "metrics": [ { "cvssV3_1": { "scope": "UNCHANGED", "version": "3.1", "baseScore": 4.7, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE" } }, { "other": { "type": "ssvc", "content": { "id": "CVE-2024-50297", "role": "CISA Coordinator", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "version": "2.0.3", "timestamp": "2025-10-01T20:14:04.909182Z" } } } ], "problemTypes": [ { "descriptions": [ { "lang": "en", "type": "CWE", "cweId": "CWE-362", "description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')" } ] } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-01T20:17:20.345Z" } } ] } }