Medium 5.5Published Oct 21, 2024

CVE-2024-49948net: add more sanity checks to qdisc_pkt_len_init()

Updated under an hour ago (Oct 27, 2026, 11:40 AM ET)

Does this affect you?

It affects Linux and 8 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: net: add more sanity checks to qdisc_pkt_len_init() One path takes care of SKB_GSO_DODGY, assuming skb->len is bigger than hdr_len. virtio_net_hdr_to_skb() does not fully dissect TCP headers, it only make sure it is at least 20 bytes. It is possible for an user to provide a malicious 'GSO' packet, total length of 80 bytes. - 20 bytes of IPv4 header - 60 bytes TCP header - a small gso_size like 8 virtio_net_hdr_to_skb() would declare this packet as a normal GSO packet, because it would see 40 bytes of payload, bigger than gso_size. We need to make detect this case to not underflow qdisc_skb_cb(skb)->pkt_len.

CVSS: 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 14, 2026
First seen by InfoSec Signals: Oct 14, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 1def9238d4aa2146924994aa4b7dc861f03b9362 before d7d1a28f5dd57b4d83def876f8d7b4403bd37df9; from 1def9238d4aa2146924994aa4b7dc861f03b9362 before 473426a1d53a68dd1e718e6cd00d57936993fa6c; from 1def9238d4aa2146924994aa4b7dc861f03b9362 before 566a931a1436d0e0ad13708ea55479b95426213c; from 1def9238d4aa2146924994aa4b7dc861f03b9362 before 2415f465730e48b6e38da1c7c097317bf5dd2d20; from 1def9238d4aa2146924994aa4b7dc861f03b9362 before 27a8fabc54d2f960d47bdfbebf2bdc6e8a92a4c4; from 1def9238d4aa2146924994aa4b7dc861f03b9362 before 9b0ee571d20a238a22722126abdfde61f1b2bdd0; from 1def9238d4aa2146924994aa4b7dc861f03b9362 before ff1c3cadcf405ab37dd91418a62a7acecf3bc5e2; from 1def9238d4aa2146924994aa4b7dc861f03b9362 before 1eebe602a8d8264a12e35e39d0645fa88dbbacdd; and 1 more ranges	CNA record
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518_4_pn_dp_mfp (from the name)	from V3.1.0 before V3.1.5	CISA ADP
Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518f_4_pn_dp_mfp (from the name)	from V3.1.0 before V3.1.5	CISA ADP
Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem siemens:simatic_s7_1500_tm_mfp_gnu_linux_subsystem (from the name)	before V1.1.1	CISA ADP
Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP siemens:siplus_s7_1500_cpu_1518_4_pn_dp_mfp (from the name)	from V3.1.0 before V3.1.5	CISA ADP
Siemens RUGGEDCOM RST2428P siemens:ruggedcom_rst2428p (from the name)	before V3.2	CISA ADP
Siemens SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family siemens:scalance_xc_300_xr_300_xc_400_xr_500wg_xr_500_family (from the name)	before V3.2	CISA ADP
Siemens SCALANCE XCM-/XRM-/XCH-/XRH-300 family siemens:scalance_xcm_xrm_xch_xrh_300_family (from the name)	before V3.2	CISA ADP
linux linux_kernel linux:linux_kernel	from 3.9 before 4.19.323; from 4.20 before 5.4.285; from 5.5 before 5.10.227; from 5.11 before 5.15.168; from 5.16 before 6.1.113; from 6.2 before 6.6.55; from 6.7 before 6.10.14; from 6.11 before 6.11.3; and 1 more ranges	NVD

References

References

https://git.kernel.org/stable/c/d7d1a28f5dd57b4d83def876f8d7b4403bd37df9	patch
https://git.kernel.org/stable/c/473426a1d53a68dd1e718e6cd00d57936993fa6c	patch
https://git.kernel.org/stable/c/566a931a1436d0e0ad13708ea55479b95426213c	patch
https://git.kernel.org/stable/c/2415f465730e48b6e38da1c7c097317bf5dd2d20	patch
https://git.kernel.org/stable/c/27a8fabc54d2f960d47bdfbebf2bdc6e8a92a4c4	patch
https://git.kernel.org/stable/c/9b0ee571d20a238a22722126abdfde61f1b2bdd0	patch
https://git.kernel.org/stable/c/ff1c3cadcf405ab37dd91418a62a7acecf3bc5e2	patch
https://git.kernel.org/stable/c/1eebe602a8d8264a12e35e39d0645fa88dbbacdd	patch
https://git.kernel.org/stable/c/ab9a9a9e9647392a19e7a885b08000e89c86b535	patch
https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html
1–10 of 14

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.