GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2024-41088 (GCVE-0-2024-41088)

Vulnerability from cvelistv5 – Published: 2024-07-29 15:48 – Updated: 2026-05-11 20:25
VLAI
Title
can: mcp251xfd: fix infinite loop when xmit fails
Summary
In the Linux kernel, the following vulnerability has been resolved: can: mcp251xfd: fix infinite loop when xmit fails When the mcp251xfd_start_xmit() function fails, the driver stops processing messages, and the interrupt routine does not return, running indefinitely even after killing the running application. Error messages: [ 441.298819] mcp251xfd spi2.0 can0: ERROR in mcp251xfd_start_xmit: -16 [ 441.306498] mcp251xfd spi2.0 can0: Transmit Event FIFO buffer not empty. (seq=0x000017c7, tef_tail=0x000017cf, tef_head=0x000017d0, tx_head=0x000017d3). ... and repeat forever. The issue can be triggered when multiple devices share the same SPI interface. And there is concurrent access to the bus. The problem occurs because tx_ring->head increments even if mcp251xfd_start_xmit() fails. Consequently, the driver skips one TX package while still expecting a response in mcp251xfd_handle_tefif_one(). Resolve the issue by starting a workqueue to write the tx obj synchronously if err = -EBUSY. In case of another error, decrement tx_ring->head, remove skb from the echo stack, and drop the message. [mkl: use more imperative wording in patch description]
Severity
No CVSS data available.
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-09-10 16:20 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 55e5b97f003e85e66babb55f357627d52081a264 , < f926c022ebaabf7963bebf89a97201d66978a025 (git)
Affected: 55e5b97f003e85e66babb55f357627d52081a264 , < 3e72558c1711d524e3150103739ddd06650e291b (git)
Affected: 55e5b97f003e85e66babb55f357627d52081a264 , < 6c6b4afa59c2fb4d1759235f866d8caed2aa4729 (git)
Affected: 55e5b97f003e85e66babb55f357627d52081a264 , < d8fb63e46c884c898a38f061c2330f7729e75510 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.10
Unaffected: 0 , < 5.10 (semver)
Unaffected: 6.1.97 , ≤ 6.1.* (semver)
Unaffected: 6.6.37 , ≤ 6.6.* (semver)
Unaffected: 6.9.8 , ≤ 6.9.* (semver)
Unaffected: 6.10 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T22:00:43.442Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/f926c022ebaabf7963bebf89a97201d66978a025"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/3e72558c1711d524e3150103739ddd06650e291b"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/6c6b4afa59c2fb4d1759235f866d8caed2aa4729"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/d8fb63e46c884c898a38f061c2330f7729e75510"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-41088",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T16:20:41.900253Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:32:56.256Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/can/spi/mcp251xfd/mcp251xfd-core.c",
            "drivers/net/can/spi/mcp251xfd/mcp251xfd-tx.c",
            "drivers/net/can/spi/mcp251xfd/mcp251xfd.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "f926c022ebaabf7963bebf89a97201d66978a025",
              "status": "affected",
              "version": "55e5b97f003e85e66babb55f357627d52081a264",
              "versionType": "git"
            },
            {
              "lessThan": "3e72558c1711d524e3150103739ddd06650e291b",
              "status": "affected",
              "version": "55e5b97f003e85e66babb55f357627d52081a264",
              "versionType": "git"
            },
            {
              "lessThan": "6c6b4afa59c2fb4d1759235f866d8caed2aa4729",
              "status": "affected",
              "version": "55e5b97f003e85e66babb55f357627d52081a264",
              "versionType": "git"
            },
            {
              "lessThan": "d8fb63e46c884c898a38f061c2330f7729e75510",
              "status": "affected",
              "version": "55e5b97f003e85e66babb55f357627d52081a264",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/can/spi/mcp251xfd/mcp251xfd-core.c",
            "drivers/net/can/spi/mcp251xfd/mcp251xfd-tx.c",
            "drivers/net/can/spi/mcp251xfd/mcp251xfd.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.10"
            },
            {
              "lessThan": "5.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.37",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.9.*",
              "status": "unaffected",
              "version": "6.9.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.10",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.97",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.37",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9.8",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: mcp251xfd: fix infinite loop when xmit fails\n\nWhen the mcp251xfd_start_xmit() function fails, the driver stops\nprocessing messages, and the interrupt routine does not return,\nrunning indefinitely even after killing the running application.\n\nError messages:\n[  441.298819] mcp251xfd spi2.0 can0: ERROR in mcp251xfd_start_xmit: -16\n[  441.306498] mcp251xfd spi2.0 can0: Transmit Event FIFO buffer not empty. (seq=0x000017c7, tef_tail=0x000017cf, tef_head=0x000017d0, tx_head=0x000017d3).\n... and repeat forever.\n\nThe issue can be triggered when multiple devices share the same SPI\ninterface. And there is concurrent access to the bus.\n\nThe problem occurs because tx_ring-\u003ehead increments even if\nmcp251xfd_start_xmit() fails. Consequently, the driver skips one TX\npackage while still expecting a response in\nmcp251xfd_handle_tefif_one().\n\nResolve the issue by starting a workqueue to write the tx obj\nsynchronously if err = -EBUSY. In case of another error, decrement\ntx_ring-\u003ehead, remove skb from the echo stack, and drop the message.\n\n[mkl: use more imperative wording in patch description]"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T20:25:57.864Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/f926c022ebaabf7963bebf89a97201d66978a025"
        },
        {
          "url": "https://git.kernel.org/stable/c/3e72558c1711d524e3150103739ddd06650e291b"
        },
        {
          "url": "https://git.kernel.org/stable/c/6c6b4afa59c2fb4d1759235f866d8caed2aa4729"
        },
        {
          "url": "https://git.kernel.org/stable/c/d8fb63e46c884c898a38f061c2330f7729e75510"
        }
      ],
      "title": "can: mcp251xfd: fix infinite loop when xmit fails",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-41088",
    "datePublished": "2024-07-29T15:48:04.035Z",
    "dateReserved": "2024-07-12T12:17:45.634Z",
    "dateUpdated": "2026-05-11T20:25:57.864Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-41088",
      "date": "2026-09-17",
      "epss": "0.00227",
      "percentile": "0.13599"
    },
    "microsoft_vex": {
      "current_release_date": "2026-03-31T14:51:43.000Z",
      "cve": "CVE-2024-41088",
      "id": "msrc_CVE-2024-41088",
      "initial_release_date": "2024-07-01T07:00:00.000Z",
      "product_status:fixed": "2",
      "product_status:known_affected": "2",
      "product_status:under_investigation": "3",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "can: mcp251xfd: fix infinite loop when xmit fails",
      "url": "https://msrc.microsoft.com/csaf/vex/2024/msrc_cve-2024-41088.json",
      "version": "4"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-41088\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-07-29T16:15:04.217\",\"lastModified\":\"2026-06-17T07:47:15.370\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ncan: mcp251xfd: fix infinite loop when xmit fails\\n\\nWhen the mcp251xfd_start_xmit() function fails, the driver stops\\nprocessing messages, and the interrupt routine does not return,\\nrunning indefinitely even after killing the running application.\\n\\nError messages:\\n[  441.298819] mcp251xfd spi2.0 can0: ERROR in mcp251xfd_start_xmit: -16\\n[  441.306498] mcp251xfd spi2.0 can0: Transmit Event FIFO buffer not empty. (seq=0x000017c7, tef_tail=0x000017cf, tef_head=0x000017d0, tx_head=0x000017d3).\\n... and repeat forever.\\n\\nThe issue can be triggered when multiple devices share the same SPI\\ninterface. And there is concurrent access to the bus.\\n\\nThe problem occurs because tx_ring-\u003ehead increments even if\\nmcp251xfd_start_xmit() fails. Consequently, the driver skips one TX\\npackage while still expecting a response in\\nmcp251xfd_handle_tefif_one().\\n\\nResolve the issue by starting a workqueue to write the tx obj\\nsynchronously if err = -EBUSY. In case of another error, decrement\\ntx_ring-\u003ehead, remove skb from the echo stack, and drop the message.\\n\\n[mkl: use more imperative wording in patch description]\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: can: mcp251xfd: corrige el bucle infinito cuando falla xmit Cuando falla la funci\u00f3n mcp251xfd_start_xmit(), el controlador deja de procesar mensajes y la rutina de interrupci\u00f3n no regresa, ejecut\u00e1ndose indefinidamente incluso despu\u00e9s de finalizar el aplicaci\u00f3n en ejecuci\u00f3n. Mensajes de error: [441.298819] mcp251xfd spi2.0 can0: ERROR en mcp251xfd_start_xmit: -16 [441.306498] mcp251xfd spi2.0 can0: El b\u00fafer FIFO de evento de transmisi\u00f3n no est\u00e1 vac\u00edo. (seq=0x000017c7, tef_tail=0x000017cf, tef_head=0x000017d0, tx_head=0x000017d3). ... y repetir para siempre. El problema puede desencadenarse cuando varios dispositivos comparten la misma interfaz SPI. Y hay acceso simult\u00e1neo al autob\u00fas. El problema ocurre porque tx_ring-\u0026gt;head incrementa incluso si falla mcp251xfd_start_xmit(). En consecuencia, el controlador omite un paquete TX mientras espera una respuesta en mcp251xfd_handle_tefif_one(). Resuelva el problema iniciando una cola de trabajo para escribir el obj tx sincr\u00f3nicamente si err = -EBUSY. En caso de otro error, disminuya tx_ring-\u0026gt;head, elimine skb de la pila de eco y elimine el mensaje. [mkl: utilice una redacci\u00f3n m\u00e1s imperativa en la descripci\u00f3n del parche]\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/net/can/spi/mcp251xfd/mcp251xfd-core.c\",\"drivers/net/can/spi/mcp251xfd/mcp251xfd-tx.c\",\"drivers/net/can/spi/mcp251xfd/mcp251xfd.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"55e5b97f003e85e66babb55f357627d52081a264\",\"lessThan\":\"f926c022ebaabf7963bebf89a97201d66978a025\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"55e5b97f003e85e66babb55f357627d52081a264\",\"lessThan\":\"3e72558c1711d524e3150103739ddd06650e291b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"55e5b97f003e85e66babb55f357627d52081a264\",\"lessThan\":\"6c6b4afa59c2fb4d1759235f866d8caed2aa4729\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"55e5b97f003e85e66babb55f357627d52081a264\",\"lessThan\":\"d8fb63e46c884c898a38f061c2330f7729e75510\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/net/can/spi/mcp251xfd/mcp251xfd-core.c\",\"drivers/net/can/spi/mcp251xfd/mcp251xfd-tx.c\",\"drivers/net/can/spi/mcp251xfd/mcp251xfd.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.10\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.10\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.97\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.37\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.9.8\",\"lessThanOrEqual\":\"6.9.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.10\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-09-10T16:20:41.900253Z\",\"id\":\"CVE-2024-41088\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-835\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.10\",\"versionEndExcluding\":\"6.1.97\",\"matchCriteriaId\":\"0D1B1C19-B25B-4A8A-904D-D71AC2162CE0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.37\",\"matchCriteriaId\":\"D72E033B-5323-4C4D-8818-36E1EBC3535F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.9.8\",\"matchCriteriaId\":\"E95105F2-32E3-4C5F-9D18-7AEFD0E6275C\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/3e72558c1711d524e3150103739ddd06650e291b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/6c6b4afa59c2fb4d1759235f866d8caed2aa4729\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d8fb63e46c884c898a38f061c2330f7729e75510\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f926c022ebaabf7963bebf89a97201d66978a025\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/3e72558c1711d524e3150103739ddd06650e291b\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/6c6b4afa59c2fb4d1759235f866d8caed2aa4729\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d8fb63e46c884c898a38f061c2330f7729e75510\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f926c022ebaabf7963bebf89a97201d66978a025\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2025-11-21T14:36:39+00:00",
      "cve": "CVE-2024-41088",
      "id": "CVE-2024-41088",
      "initial_release_date": "2024-07-29T00:00:00+00:00",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: can: mcp251xfd: fix infinite loop when xmit fails",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-41088.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/f926c022ebaabf7963bebf89a97201d66978a025\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/3e72558c1711d524e3150103739ddd06650e291b\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/6c6b4afa59c2fb4d1759235f866d8caed2aa4729\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/d8fb63e46c884c898a38f061c2330f7729e75510\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-11-03T22:00:43.442Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-41088\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-10T16:20:41.900253Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-11T12:42:13.627Z\"}}], \"cna\": {\"title\": \"can: mcp251xfd: fix infinite loop when xmit fails\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"55e5b97f003e85e66babb55f357627d52081a264\", \"lessThan\": \"f926c022ebaabf7963bebf89a97201d66978a025\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"55e5b97f003e85e66babb55f357627d52081a264\", \"lessThan\": \"3e72558c1711d524e3150103739ddd06650e291b\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"55e5b97f003e85e66babb55f357627d52081a264\", \"lessThan\": \"6c6b4afa59c2fb4d1759235f866d8caed2aa4729\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"55e5b97f003e85e66babb55f357627d52081a264\", \"lessThan\": \"d8fb63e46c884c898a38f061c2330f7729e75510\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/net/can/spi/mcp251xfd/mcp251xfd-core.c\", \"drivers/net/can/spi/mcp251xfd/mcp251xfd-tx.c\", \"drivers/net/can/spi/mcp251xfd/mcp251xfd.h\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.10\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.10\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.1.97\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.37\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.9.8\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.9.*\"}, {\"status\": \"unaffected\", \"version\": \"6.10\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/net/can/spi/mcp251xfd/mcp251xfd-core.c\", \"drivers/net/can/spi/mcp251xfd/mcp251xfd-tx.c\", \"drivers/net/can/spi/mcp251xfd/mcp251xfd.h\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/f926c022ebaabf7963bebf89a97201d66978a025\"}, {\"url\": \"https://git.kernel.org/stable/c/3e72558c1711d524e3150103739ddd06650e291b\"}, {\"url\": \"https://git.kernel.org/stable/c/6c6b4afa59c2fb4d1759235f866d8caed2aa4729\"}, {\"url\": \"https://git.kernel.org/stable/c/d8fb63e46c884c898a38f061c2330f7729e75510\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ncan: mcp251xfd: fix infinite loop when xmit fails\\n\\nWhen the mcp251xfd_start_xmit() function fails, the driver stops\\nprocessing messages, and the interrupt routine does not return,\\nrunning indefinitely even after killing the running application.\\n\\nError messages:\\n[  441.298819] mcp251xfd spi2.0 can0: ERROR in mcp251xfd_start_xmit: -16\\n[  441.306498] mcp251xfd spi2.0 can0: Transmit Event FIFO buffer not empty. (seq=0x000017c7, tef_tail=0x000017cf, tef_head=0x000017d0, tx_head=0x000017d3).\\n... and repeat forever.\\n\\nThe issue can be triggered when multiple devices share the same SPI\\ninterface. And there is concurrent access to the bus.\\n\\nThe problem occurs because tx_ring-\u003ehead increments even if\\nmcp251xfd_start_xmit() fails. Consequently, the driver skips one TX\\npackage while still expecting a response in\\nmcp251xfd_handle_tefif_one().\\n\\nResolve the issue by starting a workqueue to write the tx obj\\nsynchronously if err = -EBUSY. In case of another error, decrement\\ntx_ring-\u003ehead, remove skb from the echo stack, and drop the message.\\n\\n[mkl: use more imperative wording in patch description]\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.97\", \"versionStartIncluding\": \"5.10\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.37\", \"versionStartIncluding\": \"5.10\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.9.8\", \"versionStartIncluding\": \"5.10\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.10\", \"versionStartIncluding\": \"5.10\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-05-11T20:25:57.864Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-41088\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-05-11T20:25:57.864Z\", \"dateReserved\": \"2024-07-12T12:17:45.634Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-07-29T15:48:04.035Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.