CVE-2024-35901 (GCVE-0-2024-35901)

Vulnerability from cvelistv5 – Published: 2024-05-19 08:34 – Updated: 2026-08-05 11:30
VLAI
Title
net: mana: Fix Rx DMA datasize and skb_over_panic
Summary
In the Linux kernel, the following vulnerability has been resolved: net: mana: Fix Rx DMA datasize and skb_over_panic mana_get_rxbuf_cfg() aligns the RX buffer's DMA datasize to be multiple of 64. So a packet slightly bigger than mtu+14, say 1536, can be received and cause skb_over_panic. Sample dmesg: [ 5325.237162] skbuff: skb_over_panic: text:ffffffffc043277a len:1536 put:1536 head:ff1100018b517000 data:ff1100018b517100 tail:0x700 end:0x6ea dev:<NULL> [ 5325.243689] ------------[ cut here ]------------ [ 5325.245748] kernel BUG at net/core/skbuff.c:192! [ 5325.247838] invalid opcode: 0000 [#1] PREEMPT SMP NOPTI [ 5325.258374] RIP: 0010:skb_panic+0x4f/0x60 [ 5325.302941] Call Trace: [ 5325.304389] <IRQ> [ 5325.315794] ? skb_panic+0x4f/0x60 [ 5325.317457] ? asm_exc_invalid_op+0x1f/0x30 [ 5325.319490] ? skb_panic+0x4f/0x60 [ 5325.321161] skb_put+0x4e/0x50 [ 5325.322670] mana_poll+0x6fa/0xb50 [mana] [ 5325.324578] __napi_poll+0x33/0x1e0 [ 5325.326328] net_rx_action+0x12e/0x280 As discussed internally, this alignment is not necessary. To fix this bug, remove it from the code. So oversized packets will be marked as CQE_RX_TRUNCATED by NIC, and dropped.
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-05-20 17:12 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 2fbbd712baf1c60996554326728bbdbef5616e12 , < ca58927b00385005f488b6a9905ced7a4f719aad (git)
Affected: 2fbbd712baf1c60996554326728bbdbef5616e12 , < 05cb7c41fa1a7a7b2c2a6b81bbe7c67f5c11932b (git)
Affected: 2fbbd712baf1c60996554326728bbdbef5616e12 , < c0de6ab920aafb56feab56058e46b688e694a246 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.4
Unaffected: 0 , < 6.4 (semver)
Unaffected: 6.6.26 , ≤ 6.6.* (semver)
Unaffected: 6.8.5 , ≤ 6.8.* (semver)
Unaffected: 6.9 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-35901",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-20T17:12:59.513048Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:34:11.575Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T03:21:48.589Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/ca58927b00385005f488b6a9905ced7a4f719aad"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/05cb7c41fa1a7a7b2c2a6b81bbe7c67f5c11932b"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/c0de6ab920aafb56feab56058e46b688e694a246"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/microsoft/mana/mana_en.c",
            "include/net/mana/mana.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ca58927b00385005f488b6a9905ced7a4f719aad",
              "status": "affected",
              "version": "2fbbd712baf1c60996554326728bbdbef5616e12",
              "versionType": "git"
            },
            {
              "lessThan": "05cb7c41fa1a7a7b2c2a6b81bbe7c67f5c11932b",
              "status": "affected",
              "version": "2fbbd712baf1c60996554326728bbdbef5616e12",
              "versionType": "git"
            },
            {
              "lessThan": "c0de6ab920aafb56feab56058e46b688e694a246",
              "status": "affected",
              "version": "2fbbd712baf1c60996554326728bbdbef5616e12",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/microsoft/mana/mana_en.c",
            "include/net/mana/mana.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.4"
            },
            {
              "lessThan": "6.4",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.26",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.8.*",
              "status": "unaffected",
              "version": "6.8.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.9",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.26",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8.5",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: mana: Fix Rx DMA datasize and skb_over_panic\n\nmana_get_rxbuf_cfg() aligns the RX buffer\u0027s DMA datasize to be\nmultiple of 64. So a packet slightly bigger than mtu+14, say 1536,\ncan be received and cause skb_over_panic.\n\nSample dmesg:\n[ 5325.237162] skbuff: skb_over_panic: text:ffffffffc043277a len:1536 put:1536 head:ff1100018b517000 data:ff1100018b517100 tail:0x700 end:0x6ea dev:\u003cNULL\u003e\n[ 5325.243689] ------------[ cut here ]------------\n[ 5325.245748] kernel BUG at net/core/skbuff.c:192!\n[ 5325.247838] invalid opcode: 0000 [#1] PREEMPT SMP NOPTI\n[ 5325.258374] RIP: 0010:skb_panic+0x4f/0x60\n[ 5325.302941] Call Trace:\n[ 5325.304389]  \u003cIRQ\u003e\n[ 5325.315794]  ? skb_panic+0x4f/0x60\n[ 5325.317457]  ? asm_exc_invalid_op+0x1f/0x30\n[ 5325.319490]  ? skb_panic+0x4f/0x60\n[ 5325.321161]  skb_put+0x4e/0x50\n[ 5325.322670]  mana_poll+0x6fa/0xb50 [mana]\n[ 5325.324578]  __napi_poll+0x33/0x1e0\n[ 5325.326328]  net_rx_action+0x12e/0x280\n\nAs discussed internally, this alignment is not necessary. To fix\nthis bug, remove it from the code. So oversized packets will be\nmarked as CQE_RX_TRUNCATED by NIC, and dropped."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The bug is triggered purely by a received Ethernet frame processed in the MANA NIC\u0027s NAPI RX path, before any protocol demux or socket lookup, so a remote attacker anywhere on the routed network can reach it. On the very common Azure configuration where the VM MTU is set below the path MTU (VPN Gateway / ExpressRoute / AKS overlay guidance), ordinary full-size internet packets fall directly into the oversized window.\nAC:L - The attacker fully controls the only variable that matters \u2014 packet length \u2014 and can simply sweep sizes until one lands in the (mtu+14, ALIGN(mtu+14,64)] window, which is non-empty for the default MTU 1500. No race, no memory-layout grooming, and no state outside the attacker\u0027s control is involved.\nPR:N - No authentication or credentials of any kind are needed; the panic occurs in mana_build_skb() before eth_type_trans() and before netfilter, so the frame need not even be addressed to a listening service or survive a firewall rule. Any unauthenticated party able to send a frame to the interface triggers it.\nUI:N - Triggering requires only that the victim\u0027s interface be up and receiving; the panic happens in softirq context during normal packet reception with no action by any local user or administrator.\nS:U - The vulnerable code and the impacted resource are both the host kernel \u2014 a standard in-kernel crash with no crossing of a VM, IOMMU, or sandbox security authority.\nC:N - No data is disclosed to the attacker: the overlong DMA writes the attacker\u0027s own packet bytes into the buffer\u0027s skb_shared_info scratch area within the same allocation, and skb_over_panic() aborts immediately, so no kernel memory is read back or leaked over the wire.\nI:N - The excess DMA stays inside the allocated page/fragment, targets a region that is not a live object at DMA time and is re-zeroed by napi_build_skb(), and every packet reaching it hits the unconditional BUG() in the same call path \u2014 so no adjacent object is corrupted and no write primitive is obtained.\nA:H - skb_put() detects tail \u003e end and calls skb_over_panic() \u2192 BUG() from within NAPI/softirq context, producing a fatal exception in interrupt and a full kernel panic. A single crafted packet takes the machine down, and it can be repeated at will against every affected Azure VM."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:30:52.091Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ca58927b00385005f488b6a9905ced7a4f719aad"
        },
        {
          "url": "https://git.kernel.org/stable/c/05cb7c41fa1a7a7b2c2a6b81bbe7c67f5c11932b"
        },
        {
          "url": "https://git.kernel.org/stable/c/c0de6ab920aafb56feab56058e46b688e694a246"
        }
      ],
      "title": "net: mana: Fix Rx DMA datasize and skb_over_panic",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-35901",
    "datePublished": "2024-05-19T08:34:54.879Z",
    "dateReserved": "2024-05-17T13:50:33.114Z",
    "dateUpdated": "2026-08-05T11:30:52.091Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-35901",
      "date": "2026-09-22",
      "epss": "0.00472",
      "percentile": "0.39968"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/ethernet/microsoft/mana/mana_en.c",
                  "include/net/mana/mana.h"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "ca58927b00385005f488b6a9905ced7a4f719aad",
                    "status": "affected",
                    "version": "2fbbd712baf1c60996554326728bbdbef5616e12",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "05cb7c41fa1a7a7b2c2a6b81bbe7c67f5c11932b",
                    "status": "affected",
                    "version": "2fbbd712baf1c60996554326728bbdbef5616e12",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "c0de6ab920aafb56feab56058e46b688e694a246",
                    "status": "affected",
                    "version": "2fbbd712baf1c60996554326728bbdbef5616e12",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/ethernet/microsoft/mana/mana_en.c",
                  "include/net/mana/mana.h"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.4"
                  },
                  {
                    "lessThan": "6.4",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.26",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.8.*",
                    "status": "unaffected",
                    "version": "6.8.5",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.9",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "C9C9F649-5E73-4413-8AB4-A1022F98B8DA",
                    "versionEndExcluding": "6.6.26",
                    "versionStartIncluding": "6.4",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "DBD6C99E-4250-4DFE-8447-FF2075939D10",
                    "versionEndExcluding": "6.8.5",
                    "versionStartIncluding": "6.7",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.9:rc1:*:*:*:*:*:*",
                    "matchCriteriaId": "22BEDD49-2C6D-402D-9DBF-6646F6ECD10B",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.9:rc2:*:*:*:*:*:*",
                    "matchCriteriaId": "DF73CB2A-DFFD-46FB-9BFE-AA394F27EA37",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: mana: Fix Rx DMA datasize and skb_over_panic\n\nmana_get_rxbuf_cfg() aligns the RX buffer\u0027s DMA datasize to be\nmultiple of 64. So a packet slightly bigger than mtu+14, say 1536,\ncan be received and cause skb_over_panic.\n\nSample dmesg:\n[ 5325.237162] skbuff: skb_over_panic: text:ffffffffc043277a len:1536 put:1536 head:ff1100018b517000 data:ff1100018b517100 tail:0x700 end:0x6ea dev:\u003cNULL\u003e\n[ 5325.243689] ------------[ cut here ]------------\n[ 5325.245748] kernel BUG at net/core/skbuff.c:192!\n[ 5325.247838] invalid opcode: 0000 [#1] PREEMPT SMP NOPTI\n[ 5325.258374] RIP: 0010:skb_panic+0x4f/0x60\n[ 5325.302941] Call Trace:\n[ 5325.304389]  \u003cIRQ\u003e\n[ 5325.315794]  ? skb_panic+0x4f/0x60\n[ 5325.317457]  ? asm_exc_invalid_op+0x1f/0x30\n[ 5325.319490]  ? skb_panic+0x4f/0x60\n[ 5325.321161]  skb_put+0x4e/0x50\n[ 5325.322670]  mana_poll+0x6fa/0xb50 [mana]\n[ 5325.324578]  __napi_poll+0x33/0x1e0\n[ 5325.326328]  net_rx_action+0x12e/0x280\n\nAs discussed internally, this alignment is not necessary. To fix\nthis bug, remove it from the code. So oversized packets will be\nmarked as CQE_RX_TRUNCATED by NIC, and dropped."
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net: mana: Fix Rx DMA datasize y skb_over_panic mana_get_rxbuf_cfg() alinea el tama\u00f1o de datos DMA del buffer RX para que sea m\u00faltiplo de 64. Entonces, un paquete ligeramente m\u00e1s grande que mtu+14, digamos 1536, se puede recibir y causar skb_over_panic. Dmesg de muestra: [5325.237162] skbuff: skb_over_panic: text:ffffffffc043277a len:1536 put:1536 head:ff1100018b517000 data:ff1100018b517100 tail:0x700 end:0x6ea dev: [ 689] ----------- -[ cortar aqu\u00ed ]------------ \u00a1BUG del kernel [5325.245748] en net/core/skbuff.c:192! [ 5325.247838] c\u00f3digo de operaci\u00f3n no v\u00e1lido: 0000 [#1] PREEMPT SMP NOPTI [ 5325.258374] RIP: 0010:skb_panic+0x4f/0x60 [ 5325.302941] Seguimiento de llamadas: [ 5325.304389]  [ 5325.315794] ? skb_panic+0x4f/0x60 [5325.317457]? asm_exc_invalid_op+0x1f/0x30 [5325.319490]? skb_panic+0x4f/0x60 [ 5325.321161] skb_put+0x4e/0x50 [ 5325.322670] mana_poll+0x6fa/0xb50 [mana] [ 5325.324578] __napi_poll+0x33/0x1e0 [ 5325.326328 ] net_rx_action+0x12e/0x280 Como se analiz\u00f3 internamente, esta alineaci\u00f3n no es necesaria. Para corregir este error, elim\u00ednelo del c\u00f3digo. Por lo tanto, los paquetes de gran tama\u00f1o ser\u00e1n marcados como CQE_RX_TRUNCATED por NIC y descartados."
          }
        ],
        "id": "CVE-2024-35901",
        "lastModified": "2026-08-04T11:18:09.400",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 3.6,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 5.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 3.6,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2024-35901",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-20T17:12:59.513048Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2024-05-19T09:15:10.967",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/05cb7c41fa1a7a7b2c2a6b81bbe7c67f5c11932b"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/c0de6ab920aafb56feab56058e46b688e694a246"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/ca58927b00385005f488b6a9905ced7a4f719aad"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/05cb7c41fa1a7a7b2c2a6b81bbe7c67f5c11932b"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/c0de6ab920aafb56feab56058e46b688e694a246"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/ca58927b00385005f488b6a9905ced7a4f719aad"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-401"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-08-04T22:47:29+00:00",
      "cve": "CVE-2024-35901",
      "id": "CVE-2024-35901",
      "initial_release_date": "2024-05-19T00:00:00+00:00",
      "product_status:known_affected": "156",
      "product_status:known_not_affected": "42",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: net: mana: Fix Rx DMA datasize and skb_over_panic",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-35901.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "providerMetadata": {
              "dateUpdated": "2024-08-02T03:21:48.589Z",
              "orgId": "af854a3a-2127-422b-91ae-364da2661108",
              "shortName": "CVE"
            },
            "references": [
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/ca58927b00385005f488b6a9905ced7a4f719aad"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/05cb7c41fa1a7a7b2c2a6b81bbe7c67f5c11932b"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/c0de6ab920aafb56feab56058e46b688e694a246"
              }
            ],
            "title": "CVE Program Container"
          },
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2024-35901",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2024-05-20T17:12:59.513048Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2024-05-23T19:01:25.059Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Linux",
              "programFiles": [
                "drivers/net/ethernet/microsoft/mana/mana_en.c",
                "include/net/mana/mana.h"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "lessThan": "ca58927b00385005f488b6a9905ced7a4f719aad",
                  "status": "affected",
                  "version": "2fbbd712baf1c60996554326728bbdbef5616e12",
                  "versionType": "git"
                },
                {
                  "lessThan": "05cb7c41fa1a7a7b2c2a6b81bbe7c67f5c11932b",
                  "status": "affected",
                  "version": "2fbbd712baf1c60996554326728bbdbef5616e12",
                  "versionType": "git"
                },
                {
                  "lessThan": "c0de6ab920aafb56feab56058e46b688e694a246",
                  "status": "affected",
                  "version": "2fbbd712baf1c60996554326728bbdbef5616e12",
                  "versionType": "git"
                }
              ]
            },
            {
              "defaultStatus": "affected",
              "product": "Linux",
              "programFiles": [
                "drivers/net/ethernet/microsoft/mana/mana_en.c",
                "include/net/mana/mana.h"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "status": "affected",
                  "version": "6.4"
                },
                {
                  "lessThan": "6.4",
                  "status": "unaffected",
                  "version": "0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.6.*",
                  "status": "unaffected",
                  "version": "6.6.26",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.8.*",
                  "status": "unaffected",
                  "version": "6.8.5",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "*",
                  "status": "unaffected",
                  "version": "6.9",
                  "versionType": "original_commit_for_fix"
                }
              ]
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.6.26",
                      "versionStartIncluding": "6.4",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.8.5",
                      "versionStartIncluding": "6.4",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.9",
                      "versionStartIncluding": "6.4",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: mana: Fix Rx DMA datasize and skb_over_panic\n\nmana_get_rxbuf_cfg() aligns the RX buffer\u0027s DMA datasize to be\nmultiple of 64. So a packet slightly bigger than mtu+14, say 1536,\ncan be received and cause skb_over_panic.\n\nSample dmesg:\n[ 5325.237162] skbuff: skb_over_panic: text:ffffffffc043277a len:1536 put:1536 head:ff1100018b517000 data:ff1100018b517100 tail:0x700 end:0x6ea dev:\u003cNULL\u003e\n[ 5325.243689] ------------[ cut here ]------------\n[ 5325.245748] kernel BUG at net/core/skbuff.c:192!\n[ 5325.247838] invalid opcode: 0000 [#1] PREEMPT SMP NOPTI\n[ 5325.258374] RIP: 0010:skb_panic+0x4f/0x60\n[ 5325.302941] Call Trace:\n[ 5325.304389]  \u003cIRQ\u003e\n[ 5325.315794]  ? skb_panic+0x4f/0x60\n[ 5325.317457]  ? asm_exc_invalid_op+0x1f/0x30\n[ 5325.319490]  ? skb_panic+0x4f/0x60\n[ 5325.321161]  skb_put+0x4e/0x50\n[ 5325.322670]  mana_poll+0x6fa/0xb50 [mana]\n[ 5325.324578]  __napi_poll+0x33/0x1e0\n[ 5325.326328]  net_rx_action+0x12e/0x280\n\nAs discussed internally, this alignment is not necessary. To fix\nthis bug, remove it from the code. So oversized packets will be\nmarked as CQE_RX_TRUNCATED by NIC, and dropped."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "scenarios": [
                {
                  "lang": "en",
                  "value": "AV:N - The bug is triggered purely by a received Ethernet frame processed in the MANA NIC\u0027s NAPI RX path, before any protocol demux or socket lookup, so a remote attacker anywhere on the routed network can reach it. On the very common Azure configuration where the VM MTU is set below the path MTU (VPN Gateway / ExpressRoute / AKS overlay guidance), ordinary full-size internet packets fall directly into the oversized window.\nAC:L - The attacker fully controls the only variable that matters \u2014 packet length \u2014 and can simply sweep sizes until one lands in the (mtu+14, ALIGN(mtu+14,64)] window, which is non-empty for the default MTU 1500. No race, no memory-layout grooming, and no state outside the attacker\u0027s control is involved.\nPR:N - No authentication or credentials of any kind are needed; the panic occurs in mana_build_skb() before eth_type_trans() and before netfilter, so the frame need not even be addressed to a listening service or survive a firewall rule. Any unauthenticated party able to send a frame to the interface triggers it.\nUI:N - Triggering requires only that the victim\u0027s interface be up and receiving; the panic happens in softirq context during normal packet reception with no action by any local user or administrator.\nS:U - The vulnerable code and the impacted resource are both the host kernel \u2014 a standard in-kernel crash with no crossing of a VM, IOMMU, or sandbox security authority.\nC:N - No data is disclosed to the attacker: the overlong DMA writes the attacker\u0027s own packet bytes into the buffer\u0027s skb_shared_info scratch area within the same allocation, and skb_over_panic() aborts immediately, so no kernel memory is read back or leaked over the wire.\nI:N - The excess DMA stays inside the allocated page/fragment, targets a region that is not a live object at DMA time and is re-zeroed by napi_build_skb(), and every packet reaching it hits the unconditional BUG() in the same call path \u2014 so no adjacent object is corrupted and no write primitive is obtained.\nA:H - skb_put() detects tail \u003e end and calls skb_over_panic() \u2192 BUG() from within NAPI/softirq context, producing a fatal exception in interrupt and a full kernel panic. A single crafted packet takes the machine down, and it can be repeated at will against every affected Azure VM."
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-05T11:30:52.091Z",
            "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "shortName": "Linux"
          },
          "references": [
            {
              "url": "https://git.kernel.org/stable/c/ca58927b00385005f488b6a9905ced7a4f719aad"
            },
            {
              "url": "https://git.kernel.org/stable/c/05cb7c41fa1a7a7b2c2a6b81bbe7c67f5c11932b"
            },
            {
              "url": "https://git.kernel.org/stable/c/c0de6ab920aafb56feab56058e46b688e694a246"
            }
          ],
          "title": "net: mana: Fix Rx DMA datasize and skb_over_panic",
          "x_generator": {
            "engine": "bippy-1.2.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "assignerShortName": "Linux",
        "cveId": "CVE-2024-35901",
        "datePublished": "2024-05-19T08:34:54.879Z",
        "dateReserved": "2024-05-17T13:50:33.114Z",
        "dateUpdated": "2026-08-05T11:30:52.091Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.