CVE-2024-41090: In the Linux kernel, the following vulnerability has been resolved: tap: add missing verification for short frame The cited commit missed to check a...

Description

In the Linux kernel, the following vulnerability has been resolved: tap: add missing verification for short frame The cited commit missed to check against the validity of the frame length in the tap_get_user_xdp() path, which could cause a corrupted skb to be sent downstack. Even before the skb is transmitted, the tap_get_user_xdp()-->skb_set_network_header() may assume the size is more than ETH_HLEN. Once transmitted, this could either cause out-of-bound access beyond the actual length, or confuse the underlayer with incorrect or inconsistent header length in the skb metadata. In the alternative path, tap_get_user() already prohibits short frame which has the length less than Ethernet header size from being transmitted. This is to drop any frame shorter than the Ethernet header size just like how tap_get_user() does. CVE: CVE-2024-41090

Metrics

CVSS 3.1

7.1/10

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

EPSS Probability

0.26%

16.8th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-125

Affected Software

Vendor	Product	Versions
Linux	Linux Kernel	>= 4.20, < 5.4.281
Linux	Linux Kernel	>= 5.5, < 5.10.223
Linux	Linux Kernel	>= 5.11, < 5.15.164
Linux	Linux Kernel	>= 5.16, < 6.1.102
Linux	Linux Kernel	>= 6.2, < 6.6.43
Linux	Linux Kernel	>= 6.7, < 6.9.12
Linux	Linux Kernel	>= 6.10, < 6.10.2

References

Timeline

Published: Jul 29, 2024
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2024-41090?

In the Linux kernel, the following vulnerability has been resolved: tap: add missing verification for short frame The cited commit missed to check against the validity of the frame length in the tap_get_user_xdp() path, which could cause a corrupted skb to be sent downstack. Even before the skb is transmitted, the tap_get_user_xdp()-->skb_set_network_header() may assume the size is more than ETH_HLEN. Once transmitted, this could either cause out-of-bound access beyond the actual length, or confuse the underlayer with incorrect or inconsistent header length in the skb metadata. In the alternative path, tap_get_user() already prohibits short frame which has the length less than Ethernet header size from being transmitted. This is to drop any frame shorter than the Ethernet header size just like how tap_get_user() does. CVE: CVE-2024-41090

How severe is CVE-2024-41090?

CVE-2024-41090 has a CVSS score of 7.1/10 (HIGH severity). The EPSS model estimates a 0.26% probability of exploitation in the next 30 days.

How do I fix CVE-2024-41090?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.