CVE-2024-50258

net: fix crash when config small gso_max_size/gso_ipv4_max_size

State: Published
Severity: Not scored
Published: Nov 9, 2024
Updated: May 11, 2026
Reserved: Oct 21, 2024

Description

In the Linux kernel, the following vulnerability has been resolved:

net: fix crash when config small gso_max_size/gso_ipv4_max_size

Config a small gso_max_size/gso_ipv4_max_size will lead to an underflow in sk_dst_gso_max_size(), which may trigger a BUG_ON crash, because sk->sk_gso_max_size would be much bigger than device limits. Call Trace: tcp_write_xmit tso_segs = tcp_init_tso_segs(skb, mss_now); tcp_set_skb_tso_segs tcp_skb_pcount_set // skb->len = 524288, mss_now = 8 // u16 tso_segs = 524288/8 = 65535 -> 0 tso_segs = DIV_ROUND_UP(skb->len, mss_now) BUG_ON(!tso_segs) Add check for the minimum value of gso_max_size and gso_ipv4_max_size.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	46e6b992c2502b094e61da6994f1363f3b7c1413 to before 90c8482a5d9791259ba77bfdc1849fc5128b4be7Affected 46e6b992c2502b094e61da6994f1363f3b7c1413 to before e9365368b483328639c03fc730448dccd5a25b6bAffected 46e6b992c2502b094e61da6994f1363f3b7c1413 to before ac5977001eee7660c643f8e07a2de9001990b7b8Affected 46e6b992c2502b094e61da6994f1363f3b7c1413 to before e72fd1389a5364bc6aa6312ecf30bdb5891b9486Affected 46e6b992c2502b094e61da6994f1363f3b7c1413 to before 9ab5cf19fb0e4680f95e506d6c544259bf1111c4Affected
LinuxLinux	4.16Affected before 4.16Not affected 5.15.181 through 5.15.Not affected 6.1.120 through 6.1.Not affected 6.6.60 through 6.6.Not affected 6.11.7 through 6.11.Not affected 6.12 and laterNot affected

Product

Versions

LinuxLinux

46e6b992c2502b094e61da6994f1363f3b7c1413 to before 90c8482a5d9791259ba77bfdc1849fc5128b4be7Affected
46e6b992c2502b094e61da6994f1363f3b7c1413 to before e9365368b483328639c03fc730448dccd5a25b6bAffected
46e6b992c2502b094e61da6994f1363f3b7c1413 to before ac5977001eee7660c643f8e07a2de9001990b7b8Affected
46e6b992c2502b094e61da6994f1363f3b7c1413 to before e72fd1389a5364bc6aa6312ecf30bdb5891b9486Affected
46e6b992c2502b094e61da6994f1363f3b7c1413 to before 9ab5cf19fb0e4680f95e506d6c544259bf1111c4Affected

LinuxLinux

4.16Affected
before 4.16Not affected
5.15.181 through 5.15.*Not affected
6.1.120 through 6.1.*Not affected
6.6.60 through 6.6.*Not affected
6.11.7 through 6.11.*Not affected
6.12 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.