CVE-2024-36974

net/sched: taprio: always validate TCA_TAPRIO_ATTR_PRIOMAP

State: Published
Severity: 7.8 High
Published: Jun 18, 2024
Updated: Oct 15, 2026
Reserved: May 30, 2024

Description

In the Linux kernel, the following vulnerability has been resolved:

net/sched: taprio: always validate TCA_TAPRIO_ATTR_PRIOMAP

If one TCA_TAPRIO_ATTR_PRIOMAP attribute has been provided, taprio_parse_mqprio_opt() must validate it, or userspace can inject arbitrary data to the kernel, the second time taprio_change() is called.

First call (with valid attributes) sets dev->num_tc to a non zero value.

Second call (with arbitrary mqprio attributes) returns early from taprio_parse_mqprio_opt() and bad things can happen.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	a3d43c0d56f1b94e74963a2fbadfb70126d92213 to before c6041e7124464ce7e896ee3f912897ce88a0c4ecAffected a3d43c0d56f1b94e74963a2fbadfb70126d92213 to before 6db4af09987cc5d5f0136bd46148b0e0460dae5bAffected a3d43c0d56f1b94e74963a2fbadfb70126d92213 to before d3dde4c217f0c31ab0621912e682b57e677dd923Affected a3d43c0d56f1b94e74963a2fbadfb70126d92213 to before 0bf6cc96612bd396048f57d63f1ad454a846e39cAffected a3d43c0d56f1b94e74963a2fbadfb70126d92213 to before 724050ae4b76e4fae05a923cb54101d792cf4404Affected a3d43c0d56f1b94e74963a2fbadfb70126d92213 to before c37a27a35eadb59286c9092c49c241270c802ae2Affected a3d43c0d56f1b94e74963a2fbadfb70126d92213 to before f921a58ae20852d188f70842431ce6519c4fdc36Affected
LinuxLinux	5.2Affected before 5.2Not affected 5.4.279 through 5.4.Not affected 5.10.221 through 5.10.Not affected 5.15.162 through 5.15.Not affected 6.1.95 through 6.1.Not affected 6.6.35 through 6.6.Not affected 6.9.6 through 6.9.Not affected 6.10 and laterNot affected

Product

Versions

LinuxLinux

a3d43c0d56f1b94e74963a2fbadfb70126d92213 to before c6041e7124464ce7e896ee3f912897ce88a0c4ecAffected
a3d43c0d56f1b94e74963a2fbadfb70126d92213 to before 6db4af09987cc5d5f0136bd46148b0e0460dae5bAffected
a3d43c0d56f1b94e74963a2fbadfb70126d92213 to before d3dde4c217f0c31ab0621912e682b57e677dd923Affected
a3d43c0d56f1b94e74963a2fbadfb70126d92213 to before 0bf6cc96612bd396048f57d63f1ad454a846e39cAffected
a3d43c0d56f1b94e74963a2fbadfb70126d92213 to before 724050ae4b76e4fae05a923cb54101d792cf4404Affected
a3d43c0d56f1b94e74963a2fbadfb70126d92213 to before c37a27a35eadb59286c9092c49c241270c802ae2Affected
a3d43c0d56f1b94e74963a2fbadfb70126d92213 to before f921a58ae20852d188f70842431ce6519c4fdc36Affected

LinuxLinux

5.2Affected
before 5.2Not affected
5.4.279 through 5.4.*Not affected
5.10.221 through 5.10.*Not affected
5.15.162 through 5.15.*Not affected
6.1.95 through 6.1.*Not affected
6.6.35 through 6.6.*Not affected
6.9.6 through 6.9.*Not affected
6.10 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.