GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2024-50258 (GCVE-0-2024-50258)

Vulnerability from cvelistv5 – Published: 2024-11-09 10:15 – Updated: 2026-05-11 20:48
VLAI
Title
net: fix crash when config small gso_max_size/gso_ipv4_max_size
Summary
In the Linux kernel, the following vulnerability has been resolved: net: fix crash when config small gso_max_size/gso_ipv4_max_size Config a small gso_max_size/gso_ipv4_max_size will lead to an underflow in sk_dst_gso_max_size(), which may trigger a BUG_ON crash, because sk->sk_gso_max_size would be much bigger than device limits. Call Trace: tcp_write_xmit tso_segs = tcp_init_tso_segs(skb, mss_now); tcp_set_skb_tso_segs tcp_skb_pcount_set // skb->len = 524288, mss_now = 8 // u16 tso_segs = 524288/8 = 65535 -> 0 tso_segs = DIV_ROUND_UP(skb->len, mss_now) BUG_ON(!tso_segs) Add check for the minimum value of gso_max_size and gso_ipv4_max_size.
Severity
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 46e6b992c2502b094e61da6994f1363f3b7c1413 , < 90c8482a5d9791259ba77bfdc1849fc5128b4be7 (git)
Affected: 46e6b992c2502b094e61da6994f1363f3b7c1413 , < e9365368b483328639c03fc730448dccd5a25b6b (git)
Affected: 46e6b992c2502b094e61da6994f1363f3b7c1413 , < ac5977001eee7660c643f8e07a2de9001990b7b8 (git)
Affected: 46e6b992c2502b094e61da6994f1363f3b7c1413 , < e72fd1389a5364bc6aa6312ecf30bdb5891b9486 (git)
Affected: 46e6b992c2502b094e61da6994f1363f3b7c1413 , < 9ab5cf19fb0e4680f95e506d6c544259bf1111c4 (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.16
Unaffected: 0 , < 4.16 (semver)
Unaffected: 5.15.181 , ≤ 5.15.* (semver)
Unaffected: 6.1.120 , ≤ 6.1.* (semver)
Unaffected: 6.6.60 , ≤ 6.6.* (semver)
Unaffected: 6.11.7 , ≤ 6.11.* (semver)
Unaffected: 6.12 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T20:44:40.488Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/core/rtnetlink.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "90c8482a5d9791259ba77bfdc1849fc5128b4be7",
              "status": "affected",
              "version": "46e6b992c2502b094e61da6994f1363f3b7c1413",
              "versionType": "git"
            },
            {
              "lessThan": "e9365368b483328639c03fc730448dccd5a25b6b",
              "status": "affected",
              "version": "46e6b992c2502b094e61da6994f1363f3b7c1413",
              "versionType": "git"
            },
            {
              "lessThan": "ac5977001eee7660c643f8e07a2de9001990b7b8",
              "status": "affected",
              "version": "46e6b992c2502b094e61da6994f1363f3b7c1413",
              "versionType": "git"
            },
            {
              "lessThan": "e72fd1389a5364bc6aa6312ecf30bdb5891b9486",
              "status": "affected",
              "version": "46e6b992c2502b094e61da6994f1363f3b7c1413",
              "versionType": "git"
            },
            {
              "lessThan": "9ab5cf19fb0e4680f95e506d6c544259bf1111c4",
              "status": "affected",
              "version": "46e6b992c2502b094e61da6994f1363f3b7c1413",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/core/rtnetlink.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.16"
            },
            {
              "lessThan": "4.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.181",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.120",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.60",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.11.*",
              "status": "unaffected",
              "version": "6.11.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.12",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.181",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.120",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.60",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11.7",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: fix crash when config small gso_max_size/gso_ipv4_max_size\n\nConfig a small gso_max_size/gso_ipv4_max_size will lead to an underflow\nin sk_dst_gso_max_size(), which may trigger a BUG_ON crash,\nbecause sk-\u003esk_gso_max_size would be much bigger than device limits.\nCall Trace:\ntcp_write_xmit\n    tso_segs = tcp_init_tso_segs(skb, mss_now);\n        tcp_set_skb_tso_segs\n            tcp_skb_pcount_set\n                // skb-\u003elen = 524288, mss_now = 8\n                // u16 tso_segs = 524288/8 = 65535 -\u003e 0\n                tso_segs = DIV_ROUND_UP(skb-\u003elen, mss_now)\n    BUG_ON(!tso_segs)\nAdd check for the minimum value of gso_max_size and gso_ipv4_max_size."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T20:48:38.389Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/90c8482a5d9791259ba77bfdc1849fc5128b4be7"
        },
        {
          "url": "https://git.kernel.org/stable/c/e9365368b483328639c03fc730448dccd5a25b6b"
        },
        {
          "url": "https://git.kernel.org/stable/c/ac5977001eee7660c643f8e07a2de9001990b7b8"
        },
        {
          "url": "https://git.kernel.org/stable/c/e72fd1389a5364bc6aa6312ecf30bdb5891b9486"
        },
        {
          "url": "https://git.kernel.org/stable/c/9ab5cf19fb0e4680f95e506d6c544259bf1111c4"
        }
      ],
      "title": "net: fix crash when config small gso_max_size/gso_ipv4_max_size",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-50258",
    "datePublished": "2024-11-09T10:15:11.311Z",
    "dateReserved": "2024-10-21T19:36:19.981Z",
    "dateUpdated": "2026-05-11T20:48:38.389Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-50258",
      "date": "2026-09-17",
      "epss": "0.00218",
      "percentile": "0.12499"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-50258\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-11-09T11:15:11.413\",\"lastModified\":\"2026-06-17T08:04:01.957\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet: fix crash when config small gso_max_size/gso_ipv4_max_size\\n\\nConfig a small gso_max_size/gso_ipv4_max_size will lead to an underflow\\nin sk_dst_gso_max_size(), which may trigger a BUG_ON crash,\\nbecause sk-\u003esk_gso_max_size would be much bigger than device limits.\\nCall Trace:\\ntcp_write_xmit\\n    tso_segs = tcp_init_tso_segs(skb, mss_now);\\n        tcp_set_skb_tso_segs\\n            tcp_skb_pcount_set\\n                // skb-\u003elen = 524288, mss_now = 8\\n                // u16 tso_segs = 524288/8 = 65535 -\u003e 0\\n                tso_segs = DIV_ROUND_UP(skb-\u003elen, mss_now)\\n    BUG_ON(!tso_segs)\\nAdd check for the minimum value of gso_max_size and gso_ipv4_max_size.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net: se corrige el fallo al configurar un gso_max_size/gso_ipv4_max_size peque\u00f1o. Configurar un gso_max_size/gso_ipv4_max_size peque\u00f1o provocar\u00e1 un desbordamiento en sk_dst_gso_max_size(), lo que puede desencadenar un fallo BUG_ON, porque sk-\u0026gt;sk_gso_max_size ser\u00eda mucho mayor que los l\u00edmites del dispositivo. Seguimiento de llamadas: tcp_write_xmit tso_segs = tcp_init_tso_segs(skb, mss_now); tcp_set_skb_tso_segs tcp_skb_pcount_set // skb-\u0026gt;len = 524288, mss_now = 8 // u16 tso_segs = 524288/8 = 65535 -\u0026gt; 0 tso_segs = DIV_ROUND_UP(skb-\u0026gt;len, mss_now) BUG_ON(!tso_segs) Agregar verificaci\u00f3n para el valor m\u00ednimo de gso_max_size y gso_ipv4_max_size.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/core/rtnetlink.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"46e6b992c2502b094e61da6994f1363f3b7c1413\",\"lessThan\":\"90c8482a5d9791259ba77bfdc1849fc5128b4be7\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"46e6b992c2502b094e61da6994f1363f3b7c1413\",\"lessThan\":\"e9365368b483328639c03fc730448dccd5a25b6b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"46e6b992c2502b094e61da6994f1363f3b7c1413\",\"lessThan\":\"ac5977001eee7660c643f8e07a2de9001990b7b8\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"46e6b992c2502b094e61da6994f1363f3b7c1413\",\"lessThan\":\"e72fd1389a5364bc6aa6312ecf30bdb5891b9486\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"46e6b992c2502b094e61da6994f1363f3b7c1413\",\"lessThan\":\"9ab5cf19fb0e4680f95e506d6c544259bf1111c4\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/core/rtnetlink.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.16\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.16\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.181\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.120\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.60\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.11.7\",\"lessThanOrEqual\":\"6.11.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-191\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.16\",\"versionEndIncluding\":\"6.6.60\",\"matchCriteriaId\":\"3963E830-C9E7-4330-AF4D-17893E6C5472\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndIncluding\":\"6.11.7\",\"matchCriteriaId\":\"B29C9329-20A2-46C3-8262-6601FBA189E8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.12:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"7F361E1D-580F-4A2D-A509-7615F73167A1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.12:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"925478D0-3E3D-4E6F-ACD5-09F28D5DF82C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.12:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"3C95E234-D335-4B6C-96BF-E2CEBD8654ED\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.12:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"E0F717D8-3014-4F84-8086-0124B2111379\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.12:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"24DBE6C7-2AAE-4818-AED2-E131F153D2FA\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/90c8482a5d9791259ba77bfdc1849fc5128b4be7\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/9ab5cf19fb0e4680f95e506d6c544259bf1111c4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ac5977001eee7660c643f8e07a2de9001990b7b8\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e72fd1389a5364bc6aa6312ecf30bdb5891b9486\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e9365368b483328639c03fc730448dccd5a25b6b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-14T12:25:19+00:00",
      "cve": "CVE-2024-50258",
      "id": "CVE-2024-50258",
      "initial_release_date": "2024-11-09T00:00:00+00:00",
      "product_status:known_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: net: fix crash when config small gso_max_size/gso_ipv4_max_size",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-50258.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.