CVE-2024-36244

net/sched: taprio: extend minimum interval restriction to entire cycle too

MEDIUM
5.5
CVSS Score
Published: June 21, 2024 at 10:18 AM UTC
Updated: June 17, 2026 at 07:36 AM UTC
1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Severity
MEDIUM5.5
Exploit prediction
EPSS 0.2%
SSVC
No known exploit

Description

In the Linux kernel, the following vulnerability has been resolved: net/sched: taprio: extend minimum interval restriction to entire cycle too It is possible for syzbot to side-step the restriction imposed by the blamed commit in the Fixes: tag, because the taprio UAPI permits a cycle-time different from (and potentially shorter than) the sum of entry intervals. We need one more restriction, which is that the cycle time itself must be larger than N * ETH_ZLEN bit times, where N is the number of schedule entries. This restriction needs to apply regardless of whether the cycle time came from the user or was the implicit, auto-calculated value, so we move the existing "cycle == 0" check outside the "if "(!new->cycle_time)" branch. This way covers both conditions and scenarios. Add a selftest which illustrates the issue triggered by syzbot.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

v ≥ 5.4.68v ≥ 5.8.125.4.68 ≤ v < 5.55.8.12 ≤ v < 5.95.9 ≤ v < 6.1.1195.9 ≤ v < 6.105.9 ≤ v < 6.6.335.9 ≤ v < 6.9.45.9.1 ≤ v < 6.1.1196.2 ≤ v < 6.6.336.7 ≤ v < 6.9.45.4.685.8.125.95.9 rc75.9 rc86.10 rc1817ff50796c5e364c879596509f83fcba194bb6f83bd58952b2b8543d8c48d1453975ab47a0a7504b5b73b26b3ca34574124ed7ae9c5ba8391a7f176
Vendor states this is fixed in 34d83c3e6e97867ae061d14eb52123404aab1cbc (fixed)
Vendor states this is fixed in 91f249b01fe490fce11fbb4307952ca8cce78724 (fixed)
Vendor states this is fixed in b939d1e04a90248b4cdf417b0969c270ceb992b2 (fixed)
Vendor states this is fixed in fb66df20a7201e60f2b13d7f95d031b31a8831d3 (fixed)
Affected range stops below 5.5, so it looks safe — our inference, not a vendor statement
Vendor states this is fixed in 5.9 (unaffected)
Vendor states this is fixed in 6.1.119 (unaffected)
Vendor states this is fixed in 6.10 (unaffected)
Vendor states this is fixed in 6.6.33 (unaffected)
Vendor states this is fixed in 6.9.4 (unaffected)

References (5)

Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/34d83c3e6e97867ae061d14eb52123404aab1cbc
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/91f249b01fe490fce11fbb4307952ca8cce78724
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/b939d1e04a90248b4cdf417b0969c270ceb992b2
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/fb66df20a7201e60f2b13d7f95d031b31a8831d3
Source: af854a3a-2127-422b-91ae-364da2661108
https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html

SSVC — Action Prioritization

SSVCNo known exploitNot automatablePartial impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

Attack Vector
LOCAL
Complexity
LOW
Privileges
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
NONE
Integrity
NONE
Availability
HIGH
Vector?

Quick Info

StatusMODIFIED
CWE
NVD-CWE-noinfo

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Free plan, no card