Riskcovery

CVE-2024-40999

net: ena: Add validation for completion descriptors consistency

State
Published
Severity
9.8 Critical
Published
Jul 12, 2024
Updated
Oct 30, 2026
Reserved
Jul 12, 2024

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

net: ena: Add validation for completion descriptors consistency

Validate that `first` flag is set only for the first descriptor in multi-buffer packets. In case of an invalid descriptor, a reset will occur. A new reset reason for RX data corruption has been added.

Scores

CVSSScoreVectorSource
3.19.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HLinux

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 1738cd3ed342294360d6a74d4e58800004bff854 to before 4f163a8035e76e835a984cf548b3e6922cfe145fAffected
  • 1738cd3ed342294360d6a74d4e58800004bff854 to before edb9a302cc9386142beffe5d9bbe4bfd36999eeeAffected
  • 1738cd3ed342294360d6a74d4e58800004bff854 to before 42146ee5286f16f1674a84f7c274dcca65c6ff2eAffected
  • 1738cd3ed342294360d6a74d4e58800004bff854 to before b37b98a3a0c1198bafe8c2d9ce0bc845b4e7a9a7Affected
LinuxLinux
  • 4.9Affected
  • before 4.9Not affected
  • 6.1.191 through 6.1.*Not affected
  • 6.6.160 through 6.6.*Not affected
  • 6.9.7 through 6.9.*Not affected
  • 6.10 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.