CVE-2024-27026: vmxnet3: Fix missing reserved tailroom
In the Linux kernel, the following vulnerability has been resolved:
vmxnet3: Fix missing reserved tailroom
Use rbi->len instead of rcd->len for non-dataring packet.
Found issue: XDPWARN: xdpupdateframefrombuff(line:278): Driver BUG: missing reserved tailroom WARNING: CPU: 0 PID: 0 at net/core/xdp.c:586 xdpwarn+0xf/0x20 CPU: 0 PID: 0 Comm: swapper/0 Tainted: G W O 6.5.1 #1 RIP: 0010:xdpwarn+0xf/0x20 ... ? xdpwarn+0xf/0x20 xdpdoredirect+0x15f/0x1c0 vmxnet3runxdp+0x17a/0x400 [vmxnet3] vmxnet3processxdp+0xe4/0x760 [vmxnet3] ? vmxnet3tqtxcomplete.isra.0+0x21e/0x2c0 [vmxnet3] vmxnet3rqrxcomplete+0x7ad/0x1120 [vmxnet3] vmxnet3pollrxonly+0x2d/0xa0 [vmxnet3] napipoll+0x20/0x180 netrxaction+0x177/0x390
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1 - Upgrade
Upgrade
Linux kernelto a version that resolves this vulnerability.Fixed in 6.5.1
Event History
Frequently Asked Questions
What is the severity of CVE-2024-27026?
CVE-2024-27026 is considered a moderate severity vulnerability in the Linux kernel.
How do I fix CVE-2024-27026?
To fix CVE-2024-27026, update to a fixed kernel version: 5.10.223-1, 5.10.226-1, 6.1.123-1, 6.1.119-1, 6.12.10-1, or 6.12.11-1.
What software is affected by CVE-2024-27026?
CVE-2024-27026 affects specific versions of the Linux kernel in Debian.
What is the nature of the vulnerability in CVE-2024-27026?
The nature of the vulnerability in CVE-2024-27026 involves a bug in the vmxnet3 driver related to missing reserved tailroom for non-dataring packets.
Can CVE-2024-27026 lead to system exploitation?
While CVE-2024-27026 has been identified as a bug, it may not directly allow for system exploitation, but it should be addressed to maintain system integrity.