GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2024-56656 (GCVE-0-2024-56656)

Vulnerability from cvelistv5 – Published: 2024-12-27 15:06 – Updated: 2026-08-05 11:45
VLAI
Title
bnxt_en: Fix aggregation ID mask to prevent oops on 5760X chips
Summary
In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Fix aggregation ID mask to prevent oops on 5760X chips The 5760X (P7) chip's HW GRO/LRO interface is very similar to that of the previous generation (5750X or P5). However, the aggregation ID fields in the completion structures on P7 have been redefined from 16 bits to 12 bits. The freed up 4 bits are redefined for part of the metadata such as the VLAN ID. The aggregation ID mask was not modified when adding support for P7 chips. Including the extra 4 bits for the aggregation ID can potentially cause the driver to store or fetch the packet header of GRO/LRO packets in the wrong TPA buffer. It may hit the BUG() condition in __skb_pull() because the SKB contains no valid packet header: kernel BUG at include/linux/skbuff.h:2766! Oops: invalid opcode: 0000 1 PREEMPT SMP NOPTI CPU: 4 UID: 0 PID: 0 Comm: swapper/4 Kdump: loaded Tainted: G OE 6.12.0-rc2+ #7 Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE Hardware name: Dell Inc. PowerEdge R760/0VRV9X, BIOS 1.0.1 12/27/2022 RIP: 0010:eth_type_trans+0xda/0x140 Code: 80 00 00 00 eb c1 8b 47 70 2b 47 74 48 8b 97 d0 00 00 00 83 f8 01 7e 1b 48 85 d2 74 06 66 83 3a ff 74 09 b8 00 04 00 00 eb a5 <0f> 0b b8 00 01 00 00 eb 9c 48 85 ff 74 eb 31 f6 b9 02 00 00 00 48 RSP: 0018:ff615003803fcc28 EFLAGS: 00010283 RAX: 00000000000022d2 RBX: 0000000000000003 RCX: ff2e8c25da334040 RDX: 0000000000000040 RSI: ff2e8c25c1ce8000 RDI: ff2e8c25869f9000 RBP: ff2e8c258c31c000 R08: ff2e8c25da334000 R09: 0000000000000001 R10: ff2e8c25da3342c0 R11: ff2e8c25c1ce89c0 R12: ff2e8c258e0990b0 R13: ff2e8c25bb120000 R14: ff2e8c25c1ce89c0 R15: ff2e8c25869f9000 FS: 0000000000000000(0000) GS:ff2e8c34be300000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055f05317e4c8 CR3: 000000108bac6006 CR4: 0000000000773ef0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe07f0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: <IRQ> ? die+0x33/0x90 ? do_trap+0xd9/0x100 ? eth_type_trans+0xda/0x140 ? do_error_trap+0x65/0x80 ? eth_type_trans+0xda/0x140 ? exc_invalid_op+0x4e/0x70 ? eth_type_trans+0xda/0x140 ? asm_exc_invalid_op+0x16/0x20 ? eth_type_trans+0xda/0x140 bnxt_tpa_end+0x10b/0x6b0 [bnxt_en] ? bnxt_tpa_start+0x195/0x320 [bnxt_en] bnxt_rx_pkt+0x902/0xd90 [bnxt_en] ? __bnxt_tx_int.constprop.0+0x89/0x300 [bnxt_en] ? kmem_cache_free+0x343/0x440 ? __bnxt_tx_int.constprop.0+0x24f/0x300 [bnxt_en] __bnxt_poll_work+0x193/0x370 [bnxt_en] bnxt_poll_p5+0x9a/0x300 [bnxt_en] ? try_to_wake_up+0x209/0x670 __napi_poll+0x29/0x1b0 Fix it by redefining the aggregation ID mask for P5_PLUS chips to be 12 bits. This will work because the maximum aggregation ID is less than 4096 on all P5_PLUS chips.
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-10-01 20:00 UTC
CWE
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 13d2d3d381ee9844f89bd436ab0f44204660027e , < fe9274027697c69c1430dc7ee568f82b331ef972 (git)
Affected: 13d2d3d381ee9844f89bd436ab0f44204660027e , < 24c6843b7393ebc80962b59d7ae71af91bf0dcc1 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.8
Unaffected: 0 , < 6.8 (semver)
Unaffected: 6.12.6 , ≤ 6.12.* (semver)
Unaffected: 6.13 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 5.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-56656",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-01T20:00:16.319997Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "description": "CWE-noinfo Not enough information",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-01T20:07:10.879Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/broadcom/bnxt/bnxt.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "fe9274027697c69c1430dc7ee568f82b331ef972",
              "status": "affected",
              "version": "13d2d3d381ee9844f89bd436ab0f44204660027e",
              "versionType": "git"
            },
            {
              "lessThan": "24c6843b7393ebc80962b59d7ae71af91bf0dcc1",
              "status": "affected",
              "version": "13d2d3d381ee9844f89bd436ab0f44204660027e",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/broadcom/bnxt/bnxt.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.8"
            },
            {
              "lessThan": "6.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.13",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.6",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbnxt_en: Fix aggregation ID mask to prevent oops on 5760X chips\n\nThe 5760X (P7) chip\u0027s HW GRO/LRO interface is very similar to that of\nthe previous generation (5750X or P5).  However, the aggregation ID\nfields in the completion structures on P7 have been redefined from\n16 bits to 12 bits.  The freed up 4 bits are redefined for part of the\nmetadata such as the VLAN ID.  The aggregation ID mask was not modified\nwhen adding support for P7 chips.  Including the extra 4 bits for the\naggregation ID can potentially cause the driver to store or fetch the\npacket header of GRO/LRO packets in the wrong TPA buffer.  It may hit\nthe BUG() condition in __skb_pull() because the SKB contains no valid\npacket header:\n\nkernel BUG at include/linux/skbuff.h:2766!\nOops: invalid opcode: 0000 1 PREEMPT SMP NOPTI\nCPU: 4 UID: 0 PID: 0 Comm: swapper/4 Kdump: loaded Tainted: G           OE      6.12.0-rc2+ #7\nTainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE\nHardware name: Dell Inc. PowerEdge R760/0VRV9X, BIOS 1.0.1 12/27/2022\nRIP: 0010:eth_type_trans+0xda/0x140\nCode: 80 00 00 00 eb c1 8b 47 70 2b 47 74 48 8b 97 d0 00 00 00 83 f8 01 7e 1b 48 85 d2 74 06 66 83 3a ff 74 09 b8 00 04 00 00 eb a5 \u003c0f\u003e 0b b8 00 01 00 00 eb 9c 48 85 ff 74 eb 31 f6 b9 02 00 00 00 48\nRSP: 0018:ff615003803fcc28 EFLAGS: 00010283\nRAX: 00000000000022d2 RBX: 0000000000000003 RCX: ff2e8c25da334040\nRDX: 0000000000000040 RSI: ff2e8c25c1ce8000 RDI: ff2e8c25869f9000\nRBP: ff2e8c258c31c000 R08: ff2e8c25da334000 R09: 0000000000000001\nR10: ff2e8c25da3342c0 R11: ff2e8c25c1ce89c0 R12: ff2e8c258e0990b0\nR13: ff2e8c25bb120000 R14: ff2e8c25c1ce89c0 R15: ff2e8c25869f9000\nFS:  0000000000000000(0000) GS:ff2e8c34be300000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 000055f05317e4c8 CR3: 000000108bac6006 CR4: 0000000000773ef0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe07f0 DR7: 0000000000000400\nPKRU: 55555554\nCall Trace:\n \u003cIRQ\u003e\n ? die+0x33/0x90\n ? do_trap+0xd9/0x100\n ? eth_type_trans+0xda/0x140\n ? do_error_trap+0x65/0x80\n ? eth_type_trans+0xda/0x140\n ? exc_invalid_op+0x4e/0x70\n ? eth_type_trans+0xda/0x140\n ? asm_exc_invalid_op+0x16/0x20\n ? eth_type_trans+0xda/0x140\n bnxt_tpa_end+0x10b/0x6b0 [bnxt_en]\n ? bnxt_tpa_start+0x195/0x320 [bnxt_en]\n bnxt_rx_pkt+0x902/0xd90 [bnxt_en]\n ? __bnxt_tx_int.constprop.0+0x89/0x300 [bnxt_en]\n ? kmem_cache_free+0x343/0x440\n ? __bnxt_tx_int.constprop.0+0x24f/0x300 [bnxt_en]\n __bnxt_poll_work+0x193/0x370 [bnxt_en]\n bnxt_poll_p5+0x9a/0x300 [bnxt_en]\n ? try_to_wake_up+0x209/0x670\n __napi_poll+0x29/0x1b0\n\nFix it by redefining the aggregation ID mask for P5_PLUS chips to be\n12 bits.  This will work because the maximum aggregation ID is less\nthan 4096 on all P5_PLUS chips."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The vulnerable code is the bnxt_en hardware-GRO receive path, driven entirely by completion descriptors the NIC generates from frames arriving off the wire; a remote peer\u0027s TCP stream that gets HW-aggregated on a VLAN-tagged link (the standard trunked-datacenter configuration for 5760X/BCM57608 NICs) reaches it with no local access.\nAC:L - HW GRO (NETIF_F_GRO_HW) and VLAN RX handling are enabled by default at probe, and any VLAN-tagged aggregated TCP flow deterministically sets METADATA1_VALID, forcing agg_id \u003e= 0x8000 and an out-of-bounds table index on every such packet \u2014 no race, timing window, or condition outside the attacker\u0027s influence.\nPR:N - Packet reception and TPA/GRO processing happen in NAPI softirq context before any authentication, socket lookup, or permission check; the attacker needs no account or credentials on the target.\nUI:N - Aggregation and completion processing occur automatically on packet receipt with no action by any local user or administrator.\nS:U - The corruption is confined to kernel memory managed by the same security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - bnxt_lookup_agg_idx() performs an out-of-bounds read far past the 2080-byte tpa_idx_map object, and the resulting index selects an out-of-bounds bnxt_tpa_info whose data/data_ptr/mapping fields are used to construct the skb delivered up the stack, allowing arbitrary kernel heap contents to be disclosed in received packets.\nI:H - bnxt_alloc_agg_idx() writes a u16 roughly 72 KB beyond its allocation (agg_id_tbl[0x9000] in a u16[1024] array), and bnxt_tpa_agg()/bnxt_tpa_end() then write through an agg_arr pointer fetched from out-of-bounds memory \u2014 a remote heap corruption primitive suitable for control-flow hijacking.\nA:H - The bug is documented to hit BUG() in __skb_pull() via eth_type_trans() inside NAPI softirq, producing an invalid-opcode oops/panic, and the wild pointer dereferences readily crash the kernel outright."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:45:54.136Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/fe9274027697c69c1430dc7ee568f82b331ef972"
        },
        {
          "url": "https://git.kernel.org/stable/c/24c6843b7393ebc80962b59d7ae71af91bf0dcc1"
        }
      ],
      "title": "bnxt_en: Fix aggregation ID mask to prevent oops on 5760X chips",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-56656",
    "datePublished": "2024-12-27T15:06:19.939Z",
    "dateReserved": "2024-12-27T15:00:39.841Z",
    "dateUpdated": "2026-08-05T11:45:54.136Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-56656",
      "date": "2026-09-17",
      "epss": "0.00372",
      "percentile": "0.30899"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-56656\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-12-27T15:15:25.447\",\"lastModified\":\"2026-08-04T11:22:18.860\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbnxt_en: Fix aggregation ID mask to prevent oops on 5760X chips\\n\\nThe 5760X (P7) chip\u0027s HW GRO/LRO interface is very similar to that of\\nthe previous generation (5750X or P5).  However, the aggregation ID\\nfields in the completion structures on P7 have been redefined from\\n16 bits to 12 bits.  The freed up 4 bits are redefined for part of the\\nmetadata such as the VLAN ID.  The aggregation ID mask was not modified\\nwhen adding support for P7 chips.  Including the extra 4 bits for the\\naggregation ID can potentially cause the driver to store or fetch the\\npacket header of GRO/LRO packets in the wrong TPA buffer.  It may hit\\nthe BUG() condition in __skb_pull() because the SKB contains no valid\\npacket header:\\n\\nkernel BUG at include/linux/skbuff.h:2766!\\nOops: invalid opcode: 0000 1 PREEMPT SMP NOPTI\\nCPU: 4 UID: 0 PID: 0 Comm: swapper/4 Kdump: loaded Tainted: G           OE      6.12.0-rc2+ #7\\nTainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE\\nHardware name: Dell Inc. PowerEdge R760/0VRV9X, BIOS 1.0.1 12/27/2022\\nRIP: 0010:eth_type_trans+0xda/0x140\\nCode: 80 00 00 00 eb c1 8b 47 70 2b 47 74 48 8b 97 d0 00 00 00 83 f8 01 7e 1b 48 85 d2 74 06 66 83 3a ff 74 09 b8 00 04 00 00 eb a5 \u003c0f\u003e 0b b8 00 01 00 00 eb 9c 48 85 ff 74 eb 31 f6 b9 02 00 00 00 48\\nRSP: 0018:ff615003803fcc28 EFLAGS: 00010283\\nRAX: 00000000000022d2 RBX: 0000000000000003 RCX: ff2e8c25da334040\\nRDX: 0000000000000040 RSI: ff2e8c25c1ce8000 RDI: ff2e8c25869f9000\\nRBP: ff2e8c258c31c000 R08: ff2e8c25da334000 R09: 0000000000000001\\nR10: ff2e8c25da3342c0 R11: ff2e8c25c1ce89c0 R12: ff2e8c258e0990b0\\nR13: ff2e8c25bb120000 R14: ff2e8c25c1ce89c0 R15: ff2e8c25869f9000\\nFS:  0000000000000000(0000) GS:ff2e8c34be300000(0000) knlGS:0000000000000000\\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\\nCR2: 000055f05317e4c8 CR3: 000000108bac6006 CR4: 0000000000773ef0\\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\\nDR3: 0000000000000000 DR6: 00000000fffe07f0 DR7: 0000000000000400\\nPKRU: 55555554\\nCall Trace:\\n \u003cIRQ\u003e\\n ? die+0x33/0x90\\n ? do_trap+0xd9/0x100\\n ? eth_type_trans+0xda/0x140\\n ? do_error_trap+0x65/0x80\\n ? eth_type_trans+0xda/0x140\\n ? exc_invalid_op+0x4e/0x70\\n ? eth_type_trans+0xda/0x140\\n ? asm_exc_invalid_op+0x16/0x20\\n ? eth_type_trans+0xda/0x140\\n bnxt_tpa_end+0x10b/0x6b0 [bnxt_en]\\n ? bnxt_tpa_start+0x195/0x320 [bnxt_en]\\n bnxt_rx_pkt+0x902/0xd90 [bnxt_en]\\n ? __bnxt_tx_int.constprop.0+0x89/0x300 [bnxt_en]\\n ? kmem_cache_free+0x343/0x440\\n ? __bnxt_tx_int.constprop.0+0x24f/0x300 [bnxt_en]\\n __bnxt_poll_work+0x193/0x370 [bnxt_en]\\n bnxt_poll_p5+0x9a/0x300 [bnxt_en]\\n ? try_to_wake_up+0x209/0x670\\n __napi_poll+0x29/0x1b0\\n\\nFix it by redefining the aggregation ID mask for P5_PLUS chips to be\\n12 bits.  This will work because the maximum aggregation ID is less\\nthan 4096 on all P5_PLUS chips.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: bnxt_en: Arreglar la m\u00e1scara de ID de agregaci\u00f3n para evitar errores en los chips 5760X La interfaz HW GRO/LRO del chip 5760X (P7) es muy similar a la de la generaci\u00f3n anterior (5750X o P5). Sin embargo, los campos de ID de agregaci\u00f3n en las estructuras de finalizaci\u00f3n en P7 se han redefinido de 16 bits a 12 bits. Los 4 bits liberados se redefinen para parte de los metadatos, como el ID de VLAN. La m\u00e1scara de ID de agregaci\u00f3n no se modific\u00f3 al agregar soporte para chips P7. Incluir los 4 bits adicionales para el ID de agregaci\u00f3n puede hacer que el controlador almacene o busque el encabezado del paquete de paquetes GRO/LRO en el b\u00fafer TPA incorrecto. Puede alcanzar la condici\u00f3n BUG() en __skb_pull() porque el SKB no contiene un encabezado de paquete v\u00e1lido: \u00a1ERROR del kernel en include/linux/skbuff.h:2766! Ups: c\u00f3digo de operaci\u00f3n no v\u00e1lido: 0000 1 PREEMPT SMP NOPTI CPU: 4 UID: 0 PID: 0 Comm: swapper/4 Kdump: cargado Contaminado: G OE 6.12.0-rc2+ #7 Contaminado: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE Nombre del hardware: Dell Inc. PowerEdge R760/0VRV9X, BIOS 1.0.1 27/12/2022 RIP: 0010:eth_type_trans+0xda/0x140 C\u00f3digo: 80 00 00 00 eb c1 8b 47 70 2b 47 74 48 8b 97 d0 00 00 00 83 f8 01 7e 1b 48 85 d2 74 06 66 83 3a y siguientes 74 09 b8 00 04 00 00 eb a5 \u0026lt;0f\u0026gt; 0b b8 00 01 00 00 eb 9c 48 85 y siguientes 74 eb 31 f6 b9 02 00 00 00 48 RSP: 0018:ff615003803fcc28 EFLAGS: 00010283 RAX: 00000000000022d2 RBX: 0000000000000003 RCX: ff2e8c25da334040 RDX: 0000000000000040 RSI: ff2e8c25c1ce8000 RDI: RBP: ff2e8c258c31c000 R08: ff2e8c25da334000 R09: 0000000000000001 R10: ff2e8c25da3342c0 R11: ff2e8c25c1ce89c0 R12: ff2e8c258e0990b0 R13: ff2e8c25bb120000 R14: ff2e8c25c1ce89c0 R15: ff2e8c25869f9000 FS: 0000000000000000(0000) GS:ff2e8c34be300000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055f05317e4c8 CR3: 000000108bac6006 CR4: 0000000000773ef0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe07f0 DR7: 0000000000000400 PKRU: 55555554 Rastreo de llamadas:  ? die+0x33/0x90 ? do_trap+0xd9/0x100 ? eth_type_trans+0xda/0x140 ? do_error_trap+0x65/0x80 ? eth_type_trans+0xda/0x140 ? exc_invalid_op+0x4e/0x70 ? eth_type_trans+0xda/0x140 ? asm_exc_invalid_op+0x16/0x20 ? eth_type_trans+0xda/0x140 bnxt_tpa_end+0x10b/0x6b0 [bnxt_en] ? bnxt_tpa_start+0x195/0x320 [bnxt_es] bnxt_rx_pkt+0x902/0xd90 [bnxt_es] ? __bnxt_tx_int.constprop.0+0x89/0x300 [bnxt_es] ? kmem_cache_free+0x343/0x440 ? __bnxt_tx_int.constprop.0+0x24f/0x300 [bnxt_es] __bnxt_poll_work+0x193/0x370 [bnxt_es] bnxt_poll_p5+0x9a/0x300 [bnxt_es] ? try_to_wake_up+0x209/0x670 __napi_poll+0x29/0x1b0 Solucione el problema redefiniendo la m\u00e1scara de ID de agregaci\u00f3n para los chips P5_PLUS para que sea de 12 bits. Esto funcionar\u00e1 porque la ID de agregaci\u00f3n m\u00e1xima es menor que 4096 en todos los chips P5_PLUS.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/net/ethernet/broadcom/bnxt/bnxt.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"13d2d3d381ee9844f89bd436ab0f44204660027e\",\"lessThan\":\"fe9274027697c69c1430dc7ee568f82b331ef972\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"13d2d3d381ee9844f89bd436ab0f44204660027e\",\"lessThan\":\"24c6843b7393ebc80962b59d7ae71af91bf0dcc1\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/net/ethernet/broadcom/bnxt/bnxt.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.8\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.8\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.6\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.13\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2025-10-01T20:00:16.319997Z\",\"id\":\"CVE-2024-56656\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.8\",\"versionEndExcluding\":\"6.12.6\",\"matchCriteriaId\":\"484DFE5E-76D4-49D7-9380-DED4FD15819F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"62567B3C-6CEE-46D0-BC2E-B3717FBF7D13\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"5A073481-106D-4B15-B4C7-FB0213B8E1D4\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/24c6843b7393ebc80962b59d7ae71af91bf0dcc1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/fe9274027697c69c1430dc7ee568f82b331ef972\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-05T16:31:45+00:00",
      "cve": "CVE-2024-56656",
      "id": "CVE-2024-56656",
      "initial_release_date": "2024-12-27T00:00:00+00:00",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: bnxt_en: Fix aggregation ID mask to prevent oops on 5760X chips",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-56656.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.5, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"NONE\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-56656\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-10-01T20:00:16.319997Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"description\": \"CWE-noinfo Not enough information\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-10-01T15:44:50.749Z\"}}], \"cna\": {\"title\": \"bnxt_en: Fix aggregation ID mask to prevent oops on 5760X chips\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 9.8, \"baseSeverity\": \"CRITICAL\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:N - The vulnerable code is the bnxt_en hardware-GRO receive path, driven entirely by completion descriptors the NIC generates from frames arriving off the wire; a remote peer\u0027s TCP stream that gets HW-aggregated on a VLAN-tagged link (the standard trunked-datacenter configuration for 5760X/BCM57608 NICs) reaches it with no local access.\\nAC:L - HW GRO (NETIF_F_GRO_HW) and VLAN RX handling are enabled by default at probe, and any VLAN-tagged aggregated TCP flow deterministically sets METADATA1_VALID, forcing agg_id \u003e= 0x8000 and an out-of-bounds table index on every such packet \\u2014 no race, timing window, or condition outside the attacker\u0027s influence.\\nPR:N - Packet reception and TPA/GRO processing happen in NAPI softirq context before any authentication, socket lookup, or permission check; the attacker needs no account or credentials on the target.\\nUI:N - Aggregation and completion processing occur automatically on packet receipt with no action by any local user or administrator.\\nS:U - The corruption is confined to kernel memory managed by the same security authority; no VM, IOMMU, or sandbox boundary is crossed.\\nC:H - bnxt_lookup_agg_idx() performs an out-of-bounds read far past the 2080-byte tpa_idx_map object, and the resulting index selects an out-of-bounds bnxt_tpa_info whose data/data_ptr/mapping fields are used to construct the skb delivered up the stack, allowing arbitrary kernel heap contents to be disclosed in received packets.\\nI:H - bnxt_alloc_agg_idx() writes a u16 roughly 72 KB beyond its allocation (agg_id_tbl[0x9000] in a u16[1024] array), and bnxt_tpa_agg()/bnxt_tpa_end() then write through an agg_arr pointer fetched from out-of-bounds memory \\u2014 a remote heap corruption primitive suitable for control-flow hijacking.\\nA:H - The bug is documented to hit BUG() in __skb_pull() via eth_type_trans() inside NAPI softirq, producing an invalid-opcode oops/panic, and the wild pointer dereferences readily crash the kernel outright.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"13d2d3d381ee9844f89bd436ab0f44204660027e\", \"lessThan\": \"fe9274027697c69c1430dc7ee568f82b331ef972\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"13d2d3d381ee9844f89bd436ab0f44204660027e\", \"lessThan\": \"24c6843b7393ebc80962b59d7ae71af91bf0dcc1\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/net/ethernet/broadcom/bnxt/bnxt.h\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.8\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.8\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.12.6\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.12.*\"}, {\"status\": \"unaffected\", \"version\": \"6.13\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/net/ethernet/broadcom/bnxt/bnxt.h\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/fe9274027697c69c1430dc7ee568f82b331ef972\"}, {\"url\": \"https://git.kernel.org/stable/c/24c6843b7393ebc80962b59d7ae71af91bf0dcc1\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbnxt_en: Fix aggregation ID mask to prevent oops on 5760X chips\\n\\nThe 5760X (P7) chip\u0027s HW GRO/LRO interface is very similar to that of\\nthe previous generation (5750X or P5).  However, the aggregation ID\\nfields in the completion structures on P7 have been redefined from\\n16 bits to 12 bits.  The freed up 4 bits are redefined for part of the\\nmetadata such as the VLAN ID.  The aggregation ID mask was not modified\\nwhen adding support for P7 chips.  Including the extra 4 bits for the\\naggregation ID can potentially cause the driver to store or fetch the\\npacket header of GRO/LRO packets in the wrong TPA buffer.  It may hit\\nthe BUG() condition in __skb_pull() because the SKB contains no valid\\npacket header:\\n\\nkernel BUG at include/linux/skbuff.h:2766!\\nOops: invalid opcode: 0000 1 PREEMPT SMP NOPTI\\nCPU: 4 UID: 0 PID: 0 Comm: swapper/4 Kdump: loaded Tainted: G           OE      6.12.0-rc2+ #7\\nTainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE\\nHardware name: Dell Inc. PowerEdge R760/0VRV9X, BIOS 1.0.1 12/27/2022\\nRIP: 0010:eth_type_trans+0xda/0x140\\nCode: 80 00 00 00 eb c1 8b 47 70 2b 47 74 48 8b 97 d0 00 00 00 83 f8 01 7e 1b 48 85 d2 74 06 66 83 3a ff 74 09 b8 00 04 00 00 eb a5 \u003c0f\u003e 0b b8 00 01 00 00 eb 9c 48 85 ff 74 eb 31 f6 b9 02 00 00 00 48\\nRSP: 0018:ff615003803fcc28 EFLAGS: 00010283\\nRAX: 00000000000022d2 RBX: 0000000000000003 RCX: ff2e8c25da334040\\nRDX: 0000000000000040 RSI: ff2e8c25c1ce8000 RDI: ff2e8c25869f9000\\nRBP: ff2e8c258c31c000 R08: ff2e8c25da334000 R09: 0000000000000001\\nR10: ff2e8c25da3342c0 R11: ff2e8c25c1ce89c0 R12: ff2e8c258e0990b0\\nR13: ff2e8c25bb120000 R14: ff2e8c25c1ce89c0 R15: ff2e8c25869f9000\\nFS:  0000000000000000(0000) GS:ff2e8c34be300000(0000) knlGS:0000000000000000\\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\\nCR2: 000055f05317e4c8 CR3: 000000108bac6006 CR4: 0000000000773ef0\\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\\nDR3: 0000000000000000 DR6: 00000000fffe07f0 DR7: 0000000000000400\\nPKRU: 55555554\\nCall Trace:\\n \u003cIRQ\u003e\\n ? die+0x33/0x90\\n ? do_trap+0xd9/0x100\\n ? eth_type_trans+0xda/0x140\\n ? do_error_trap+0x65/0x80\\n ? eth_type_trans+0xda/0x140\\n ? exc_invalid_op+0x4e/0x70\\n ? eth_type_trans+0xda/0x140\\n ? asm_exc_invalid_op+0x16/0x20\\n ? eth_type_trans+0xda/0x140\\n bnxt_tpa_end+0x10b/0x6b0 [bnxt_en]\\n ? bnxt_tpa_start+0x195/0x320 [bnxt_en]\\n bnxt_rx_pkt+0x902/0xd90 [bnxt_en]\\n ? __bnxt_tx_int.constprop.0+0x89/0x300 [bnxt_en]\\n ? kmem_cache_free+0x343/0x440\\n ? __bnxt_tx_int.constprop.0+0x24f/0x300 [bnxt_en]\\n __bnxt_poll_work+0x193/0x370 [bnxt_en]\\n bnxt_poll_p5+0x9a/0x300 [bnxt_en]\\n ? try_to_wake_up+0x209/0x670\\n __napi_poll+0x29/0x1b0\\n\\nFix it by redefining the aggregation ID mask for P5_PLUS chips to be\\n12 bits.  This will work because the maximum aggregation ID is less\\nthan 4096 on all P5_PLUS chips.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12.6\", \"versionStartIncluding\": \"6.8\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.13\", \"versionStartIncluding\": \"6.8\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:45:54.136Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-56656\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:45:54.136Z\", \"dateReserved\": \"2024-12-27T15:00:39.841Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-12-27T15:06:19.939Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.