Medium 6.2Published Nov 9, 2024

CVE-2024-50251netfilter: nft_payload: sanitize offset and length before calling skb_checksum()

Updated under an hour ago (Oct 27, 2026, 11:23 PM ET)

Does this affect you?

It affects Linux and 8 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_payload: sanitize offset and length before calling skb_checksum() If access to offset + length is larger than the skbuff length, then skb_checksum() triggers BUG_ON(). skb_checksum() internally subtracts the length parameter while iterating over skbuff, BUG_ON(len) at the end of it checks that the expected length to be included in the checksum calculation is fully consumed.

CVSS: 6.2 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 14, 2026
First seen by InfoSec Signals: Oct 14, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 7ec3f7b47b8d9ad7ba425726f2c58f9ddce040df before a661ed364ae6ae88c2fafa9ddc27df1af2a73701; from 7ec3f7b47b8d9ad7ba425726f2c58f9ddce040df before ac7df3fc80fc82bcc3b1e8f6ebc0d2c435d0c534; from 7ec3f7b47b8d9ad7ba425726f2c58f9ddce040df before e3e608cbad376674d19a71ccd0d41804d9393f02; from 7ec3f7b47b8d9ad7ba425726f2c58f9ddce040df before b1d2de8a669fa14c499a385e056944d5352b3b40; from 7ec3f7b47b8d9ad7ba425726f2c58f9ddce040df before d3217323525f7596427124359e76ea0d8fcc9874; 7ec3f7b47b8d9ad7ba425726f2c58f9ddce040df builds before 0ab3be58b45b996764aba0187b46de19b3e58a72; from 7ec3f7b47b8d9ad7ba425726f2c58f9ddce040df before c43e0ea848e7b9bef7a682cbc5608022d6d29d7b; from 7ec3f7b47b8d9ad7ba425726f2c58f9ddce040df before d5953d680f7e96208c29ce4139a0e38de87a57fe	CNA record
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518_4_pn_dp_mfp (from the name)	from V3.1.0 before V3.1.5	CISA ADP
Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518f_4_pn_dp_mfp (from the name)	from V3.1.0 before V3.1.5	CISA ADP
Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem siemens:simatic_s7_1500_tm_mfp_gnu_linux_subsystem (from the name)	before V1.1.1	CISA ADP
Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP siemens:siplus_s7_1500_cpu_1518_4_pn_dp_mfp (from the name)	from V3.1.0 before V3.1.5	CISA ADP
Siemens RUGGEDCOM RST2428P siemens:ruggedcom_rst2428p (from the name)	before V3.2	CISA ADP
Siemens SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family siemens:scalance_xc_300_xr_300_xc_400_xr_500wg_xr_500_family (from the name)	before V3.2	CISA ADP
Siemens SCALANCE XCM-/XRM-/XCH-/XRH-300 family siemens:scalance_xcm_xrm_xch_xrh_300_family (from the name)	before V3.2	CISA ADP
linux linux_kernel linux:linux_kernel	from 4.5 before 4.19.323; from 4.20 before 5.4.285; from 5.5 before 5.10.229; from 5.11 before 5.15.171; from 5.16 before 6.1.116; from 6.2 before 6.6.60; from 6.7 before 6.11.7; 6.12; and 4 more ranges	NVD

References

References

https://git.kernel.org/stable/c/a661ed364ae6ae88c2fafa9ddc27df1af2a73701	patch
https://git.kernel.org/stable/c/ac7df3fc80fc82bcc3b1e8f6ebc0d2c435d0c534	patch
https://git.kernel.org/stable/c/e3e608cbad376674d19a71ccd0d41804d9393f02	patch
https://git.kernel.org/stable/c/b1d2de8a669fa14c499a385e056944d5352b3b40	patch
https://git.kernel.org/stable/c/d3217323525f7596427124359e76ea0d8fcc9874	patch
https://git.kernel.org/stable/c/0ab3be58b45b996764aba0187b46de19b3e58a72	patch
https://git.kernel.org/stable/c/c43e0ea848e7b9bef7a682cbc5608022d6d29d7b	patch
https://git.kernel.org/stable/c/d5953d680f7e96208c29ce4139a0e38de87a57fe	patch
https://github.com/slavin-ayu/CVE-2024-50251-PoC
https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html
1–10 of 14

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.