Riskcovery

CVE-2024-46834

ethtool: fail closed if we can't get max channel used in indirection tables

State
Published
Severity
7.8 High
Published
Sep 27, 2024
Updated
Oct 30, 2026
Reserved
Sep 11, 2024

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

ethtool: fail closed if we can't get max channel used in indirection tables

Commit 0d1b7d6c9274 ("bnxt: fix crashes when reducing ring count with active RSS contexts") proves that allowing indirection table to contain channels with out of bounds IDs may lead to crashes. Currently the max channel check in the core gets skipped if driver can't fetch the indirection table or when we can't allocate memory.

Both of those conditions should be extremely rare but if they do happen we should try to be safe and fail the channel change.

Scores

CVSSScoreVectorSource
3.17.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HLinux

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • d4ab4286276fcd6c155bafdf4422b712068d2516 to before 83203ec6f65680109b2048c4f3e501efc14104baAffected
  • d4ab4286276fcd6c155bafdf4422b712068d2516 to before 7e6ff8c58985fbe20d131112aba0a8867cdedc59Affected
  • d4ab4286276fcd6c155bafdf4422b712068d2516 to before 101737d8b88dbd4be6010bac398fe810f1950036Affected
  • d4ab4286276fcd6c155bafdf4422b712068d2516 to before 2899d58462ba868287d6ff3acad3675e7adf934fAffected
LinuxLinux
  • 4.6Affected
  • before 4.6Not affected
  • 6.1.191 through 6.1.*Not affected
  • 6.6.160 through 6.6.*Not affected
  • 6.10.10 through 6.10.*Not affected
  • 6.11 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.