GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2024-50041 (GCVE-0-2024-50041)

Vulnerability from cvelistv5 – Published: 2024-10-21 19:39 – Updated: 2026-08-05 11:41
VLAI
Title
i40e: Fix macvlan leak by synchronizing access to mac_filter_hash
Summary
In the Linux kernel, the following vulnerability has been resolved: i40e: Fix macvlan leak by synchronizing access to mac_filter_hash This patch addresses a macvlan leak issue in the i40e driver caused by concurrent access to vsi->mac_filter_hash. The leak occurs when multiple threads attempt to modify the mac_filter_hash simultaneously, leading to inconsistent state and potential memory leaks. To fix this, we now wrap the calls to i40e_del_mac_filter() and zeroing vf->default_lan_addr.addr with spin_lock/unlock_bh(&vsi->mac_filter_hash_lock), ensuring atomic operations and preventing concurrent access. Additionally, we add lockdep_assert_held(&vsi->mac_filter_hash_lock) in i40e_add_mac_filter() to help catch similar issues in the future. Reproduction steps: 1. Spawn VFs and configure port vlan on them. 2. Trigger concurrent macvlan operations (e.g., adding and deleting portvlan and/or mac filters). 3. Observe the potential memory leak and inconsistent state in the mac_filter_hash. This synchronization ensures the integrity of the mac_filter_hash and prevents the described leak.
Severity
8.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-10-22 13:24 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: ddec6cbbe22781d17965f1e6386e5a6363c058d2 , < 9db6ce9e2738b05a3672aff4d42169cf3bb5a3e3 (git)
Affected: fed0d9f13266a22ce1fc9a97521ef9cdc6271a23 , < 9a9747288ba0a9ad4f5c9877f18dd245770ad64e (git)
Affected: fed0d9f13266a22ce1fc9a97521ef9cdc6271a23 , < 703c4d820b31bcadf465288d5746c53445f02a55 (git)
Affected: fed0d9f13266a22ce1fc9a97521ef9cdc6271a23 , < 8831abff1bd5b6bc8224f0c0671f46fbd702b5b2 (git)
Affected: fed0d9f13266a22ce1fc9a97521ef9cdc6271a23 , < dac6c7b3d33756d6ce09f00a96ea2ecd79fae9fb (git)
Affected: 8bfcbaa379694e05290fcff21f4bd40afcf88776 (git)
Affected: 5.15.54 , < 5.15.168 (semver)
Affected: 5.18.11 , < 5.19 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 5.19
Unaffected: 0 , < 5.19 (semver)
Unaffected: 5.15.168 , ≤ 5.15.* (semver)
Unaffected: 6.1.113 , ≤ 6.1.* (semver)
Unaffected: 6.6.57 , ≤ 6.6.* (semver)
Unaffected: 6.11.4 , ≤ 6.11.* (semver)
Unaffected: 6.12 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-50041",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-22T13:24:46.896116Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-22T13:28:44.245Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T22:24:48.319Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/intel/i40e/i40e_main.c",
            "drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "9db6ce9e2738b05a3672aff4d42169cf3bb5a3e3",
              "status": "affected",
              "version": "ddec6cbbe22781d17965f1e6386e5a6363c058d2",
              "versionType": "git"
            },
            {
              "lessThan": "9a9747288ba0a9ad4f5c9877f18dd245770ad64e",
              "status": "affected",
              "version": "fed0d9f13266a22ce1fc9a97521ef9cdc6271a23",
              "versionType": "git"
            },
            {
              "lessThan": "703c4d820b31bcadf465288d5746c53445f02a55",
              "status": "affected",
              "version": "fed0d9f13266a22ce1fc9a97521ef9cdc6271a23",
              "versionType": "git"
            },
            {
              "lessThan": "8831abff1bd5b6bc8224f0c0671f46fbd702b5b2",
              "status": "affected",
              "version": "fed0d9f13266a22ce1fc9a97521ef9cdc6271a23",
              "versionType": "git"
            },
            {
              "lessThan": "dac6c7b3d33756d6ce09f00a96ea2ecd79fae9fb",
              "status": "affected",
              "version": "fed0d9f13266a22ce1fc9a97521ef9cdc6271a23",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "8bfcbaa379694e05290fcff21f4bd40afcf88776",
              "versionType": "git"
            },
            {
              "lessThan": "5.15.168",
              "status": "affected",
              "version": "5.15.54",
              "versionType": "semver"
            },
            {
              "lessThan": "5.19",
              "status": "affected",
              "version": "5.18.11",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/intel/i40e/i40e_main.c",
            "drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.19"
            },
            {
              "lessThan": "5.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.168",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.113",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.57",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.11.*",
              "status": "unaffected",
              "version": "6.11.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.12",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.168",
                  "versionStartIncluding": "5.15.54",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.113",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.57",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11.4",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.18.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ni40e: Fix macvlan leak by synchronizing access to mac_filter_hash\n\nThis patch addresses a macvlan leak issue in the i40e driver caused by\nconcurrent access to vsi-\u003emac_filter_hash. The leak occurs when multiple\nthreads attempt to modify the mac_filter_hash simultaneously, leading to\ninconsistent state and potential memory leaks.\n\nTo fix this, we now wrap the calls to i40e_del_mac_filter() and zeroing\nvf-\u003edefault_lan_addr.addr with spin_lock/unlock_bh(\u0026vsi-\u003emac_filter_hash_lock),\nensuring atomic operations and preventing concurrent access.\n\nAdditionally, we add lockdep_assert_held(\u0026vsi-\u003emac_filter_hash_lock) in\ni40e_add_mac_filter() to help catch similar issues in the future.\n\nReproduction steps:\n1. Spawn VFs and configure port vlan on them.\n2. Trigger concurrent macvlan operations (e.g., adding and deleting\n\tportvlan and/or mac filters).\n3. Observe the potential memory leak and inconsistent state in the\n\tmac_filter_hash.\n\nThis synchronization ensures the integrity of the mac_filter_hash and prevents\nthe described leak."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is reached only through the i40e virtchnl mailbox from an assigned SR-IOV VF (PCIe transport) or from host-side netdev operations, not from network packets. This is logical local access to the device, so Local.\nAC:L - The attacker deterministically controls the unlocked side \u2014 `vf-\u003edriver_caps` is taken verbatim from the VF message so the gating condition is attacker-selected, and `VIRTCHNL_OP_GET_VF_RESOURCES` can be replayed without limit \u2014 while pre-populating MAC/VLAN filters lengthens the unlocked hash walk, which runs in preemptible workqueue context; on lockdep kernels the assertion fires with no race needed at all.\nPR:L - The attacker is the owner of an assigned VF \u2014 a guest VM tenant or a VFIO/DPDK userspace driver \u2014 holding no privilege on the host kernel beyond the granted device, and no host-side capability, root, or trusted-VF flag is required (the path runs before any privilege check and untrusted VFs reach it).\nUI:N - The guest drives the vulnerable path entirely on its own by writing virtchnl messages to its mailbox; no victim action is needed to enable the attack, and the deterministic lockdep-assert path requires nothing from anyone else.\nS:C - The virtchnl handler is the PF\u0027s service surface for a VF that belongs to a separate security authority (guest VM / VFIO container), and successful exploitation corrupts host kernel memory \u2014 a guest-to-host boundary crossing analogous to a hypervisor escape.\nC:H - Unsynchronized `hash_for_each_safe()` racing a concurrent `kfree()` in `i40e_sync_vsi_filters()` produces a use-after-free on a kmalloc-32 `struct i40e_mac_filter`, and corrupted hlist traversal follows attacker-groomable pointers into reallocated memory, enabling kernel heap disclosure.\nI:H - `__i40e_del_filter()` writes `f-\u003estate` into freed memory and `hash_del()` performs `*pprev = next` using pointers from a reallocated, attacker-sprayed 32-byte object \u2014 a write-what-where primitive; concurrent unlink from both sides also yields a double free.\nA:H - Concurrent unlocked hlist manipulation corrupts the filter hash, causing use-after-free, double free, and lost entries (the reported leak), any of which panic the host kernel; on `CONFIG_PROVE_LOCKING` builds a guest can also trigger the `lockdep_assert_held()` WARN on demand, which is fatal under `panic_on_warn`."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:41:11.870Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/9db6ce9e2738b05a3672aff4d42169cf3bb5a3e3"
        },
        {
          "url": "https://git.kernel.org/stable/c/9a9747288ba0a9ad4f5c9877f18dd245770ad64e"
        },
        {
          "url": "https://git.kernel.org/stable/c/703c4d820b31bcadf465288d5746c53445f02a55"
        },
        {
          "url": "https://git.kernel.org/stable/c/8831abff1bd5b6bc8224f0c0671f46fbd702b5b2"
        },
        {
          "url": "https://git.kernel.org/stable/c/dac6c7b3d33756d6ce09f00a96ea2ecd79fae9fb"
        }
      ],
      "title": "i40e: Fix macvlan leak by synchronizing access to mac_filter_hash",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-50041",
    "datePublished": "2024-10-21T19:39:40.435Z",
    "dateReserved": "2024-10-21T12:17:06.071Z",
    "dateUpdated": "2026-08-05T11:41:11.870Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-50041",
      "date": "2026-09-16",
      "epss": "0.00228",
      "percentile": "0.13771"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.15.54\", \"versionEndExcluding\": \"5.15.168\", \"matchCriteriaId\": \"D9429645-5F5B-486E-877E-5F2E0EB6202F\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.18.11\", \"versionEndExcluding\": \"5.19\", \"matchCriteriaId\": \"3F904485-FC3F-4533-8CD9-B8208F0C4707\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.19\", \"versionEndExcluding\": \"6.1.113\", \"matchCriteriaId\": \"7D848431-3C7A-4C40-BC35-515047E89ABE\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.2\", \"versionEndExcluding\": \"6.6.57\", \"matchCriteriaId\": \"05D83DB8-7465-4F88-AFB2-980011992AC1\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.7\", \"versionEndExcluding\": \"6.11.4\", \"matchCriteriaId\": \"AA84D336-CE9A-4535-B901-1AD77EC17C34\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.12:rc1:*:*:*:*:*:*\", \"matchCriteriaId\": \"7F361E1D-580F-4A2D-A509-7615F73167A1\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.12:rc2:*:*:*:*:*:*\", \"matchCriteriaId\": \"925478D0-3E3D-4E6F-ACD5-09F28D5DF82C\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ni40e: Fix macvlan leak by synchronizing access to mac_filter_hash\\n\\nThis patch addresses a macvlan leak issue in the i40e driver caused by\\nconcurrent access to vsi-\u003emac_filter_hash. The leak occurs when multiple\\nthreads attempt to modify the mac_filter_hash simultaneously, leading to\\ninconsistent state and potential memory leaks.\\n\\nTo fix this, we now wrap the calls to i40e_del_mac_filter() and zeroing\\nvf-\u003edefault_lan_addr.addr with spin_lock/unlock_bh(\u0026vsi-\u003emac_filter_hash_lock),\\nensuring atomic operations and preventing concurrent access.\\n\\nAdditionally, we add lockdep_assert_held(\u0026vsi-\u003emac_filter_hash_lock) in\\ni40e_add_mac_filter() to help catch similar issues in the future.\\n\\nReproduction steps:\\n1. Spawn VFs and configure port vlan on them.\\n2. Trigger concurrent macvlan operations (e.g., adding and deleting\\n\\tportvlan and/or mac filters).\\n3. Observe the potential memory leak and inconsistent state in the\\n\\tmac_filter_hash.\\n\\nThis synchronization ensures the integrity of the mac_filter_hash and prevents\\nthe described leak.\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: i40e: Corregir p\\u00e9rdida de macvlan sincronizando el acceso a mac_filter_hash Este parche soluciona un problema de p\\u00e9rdida de macvlan en el controlador i40e causado por el acceso simult\\u00e1neo a vsi-\u0026gt;mac_filter_hash. La p\\u00e9rdida se produce cuando varios subprocesos intentan modificar mac_filter_hash simult\\u00e1neamente, lo que genera un estado inconsistente y posibles p\\u00e9rdidas de memoria. Para solucionar esto, ahora envolvemos las llamadas a i40e_del_mac_filter() y ponemos a cero vf-\u0026gt;default_lan_addr.addr con spin_lock/unlock_bh(\u0026amp;vsi-\u0026gt;mac_filter_hash_lock), lo que garantiza operaciones at\\u00f3micas y evita el acceso simult\\u00e1neo. Adem\\u00e1s, agregamos lockdep_assert_held(\u0026amp;vsi-\u0026gt;mac_filter_hash_lock) en i40e_add_mac_filter() para ayudar a detectar problemas similares en el futuro. Pasos de reproducci\\u00f3n: 1. Genere VFs y configure el puerto VLAN en ellos. 2. Active operaciones MACVLAN simult\\u00e1neas (por ejemplo, agregar y eliminar filtros MAC o PortVLAN). 3. Observe la posible p\\u00e9rdida de memoria y el estado inconsistente en el hash de filtro MAC. Esta sincronizaci\\u00f3n garantiza la integridad del hash de filtro MAC y evita la p\\u00e9rdida descrita.\"}]",
      "id": "CVE-2024-50041",
      "lastModified": "2024-10-24T19:31:39.373",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"baseScore\": 5.5, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 3.6}]}",
      "published": "2024-10-21T20:15:17.133",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/703c4d820b31bcadf465288d5746c53445f02a55\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/8831abff1bd5b6bc8224f0c0671f46fbd702b5b2\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/9a9747288ba0a9ad4f5c9877f18dd245770ad64e\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/9db6ce9e2738b05a3672aff4d42169cf3bb5a3e3\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/dac6c7b3d33756d6ce09f00a96ea2ecd79fae9fb\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Analyzed",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-401\"}]}]"
    },
    "microsoft_vex": {
      "current_release_date": "2026-02-18T01:30:03.000Z",
      "cve": "CVE-2024-50041",
      "id": "msrc_CVE-2024-50041",
      "initial_release_date": "2024-10-01T07:00:00.000Z",
      "product_status:fixed": "5",
      "product_status:known_affected": "5",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "i40e: Fix macvlan leak by synchronizing access to mac_filter_hash",
      "url": "https://msrc.microsoft.com/csaf/vex/2024/msrc_cve-2024-50041.json",
      "version": "3"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-50041\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-10-21T20:15:17.133\",\"lastModified\":\"2026-08-04T11:21:11.180\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ni40e: Fix macvlan leak by synchronizing access to mac_filter_hash\\n\\nThis patch addresses a macvlan leak issue in the i40e driver caused by\\nconcurrent access to vsi-\u003emac_filter_hash. The leak occurs when multiple\\nthreads attempt to modify the mac_filter_hash simultaneously, leading to\\ninconsistent state and potential memory leaks.\\n\\nTo fix this, we now wrap the calls to i40e_del_mac_filter() and zeroing\\nvf-\u003edefault_lan_addr.addr with spin_lock/unlock_bh(\u0026vsi-\u003emac_filter_hash_lock),\\nensuring atomic operations and preventing concurrent access.\\n\\nAdditionally, we add lockdep_assert_held(\u0026vsi-\u003emac_filter_hash_lock) in\\ni40e_add_mac_filter() to help catch similar issues in the future.\\n\\nReproduction steps:\\n1. Spawn VFs and configure port vlan on them.\\n2. Trigger concurrent macvlan operations (e.g., adding and deleting\\n\\tportvlan and/or mac filters).\\n3. Observe the potential memory leak and inconsistent state in the\\n\\tmac_filter_hash.\\n\\nThis synchronization ensures the integrity of the mac_filter_hash and prevents\\nthe described leak.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: i40e: Corregir p\u00e9rdida de macvlan sincronizando el acceso a mac_filter_hash Este parche soluciona un problema de p\u00e9rdida de macvlan en el controlador i40e causado por el acceso simult\u00e1neo a vsi-\u0026gt;mac_filter_hash. La p\u00e9rdida se produce cuando varios subprocesos intentan modificar mac_filter_hash simult\u00e1neamente, lo que genera un estado inconsistente y posibles p\u00e9rdidas de memoria. Para solucionar esto, ahora envolvemos las llamadas a i40e_del_mac_filter() y ponemos a cero vf-\u0026gt;default_lan_addr.addr con spin_lock/unlock_bh(\u0026amp;vsi-\u0026gt;mac_filter_hash_lock), lo que garantiza operaciones at\u00f3micas y evita el acceso simult\u00e1neo. Adem\u00e1s, agregamos lockdep_assert_held(\u0026amp;vsi-\u0026gt;mac_filter_hash_lock) en i40e_add_mac_filter() para ayudar a detectar problemas similares en el futuro. Pasos de reproducci\u00f3n: 1. Genere VFs y configure el puerto VLAN en ellos. 2. Active operaciones MACVLAN simult\u00e1neas (por ejemplo, agregar y eliminar filtros MAC o PortVLAN). 3. Observe la posible p\u00e9rdida de memoria y el estado inconsistente en el hash de filtro MAC. Esta sincronizaci\u00f3n garantiza la integridad del hash de filtro MAC y evita la p\u00e9rdida descrita.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/net/ethernet/intel/i40e/i40e_main.c\",\"drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"ddec6cbbe22781d17965f1e6386e5a6363c058d2\",\"lessThan\":\"9db6ce9e2738b05a3672aff4d42169cf3bb5a3e3\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"fed0d9f13266a22ce1fc9a97521ef9cdc6271a23\",\"lessThan\":\"9a9747288ba0a9ad4f5c9877f18dd245770ad64e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"fed0d9f13266a22ce1fc9a97521ef9cdc6271a23\",\"lessThan\":\"703c4d820b31bcadf465288d5746c53445f02a55\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"fed0d9f13266a22ce1fc9a97521ef9cdc6271a23\",\"lessThan\":\"8831abff1bd5b6bc8224f0c0671f46fbd702b5b2\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"fed0d9f13266a22ce1fc9a97521ef9cdc6271a23\",\"lessThan\":\"dac6c7b3d33756d6ce09f00a96ea2ecd79fae9fb\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8bfcbaa379694e05290fcff21f4bd40afcf88776\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5.15.54\",\"lessThan\":\"5.15.168\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"5.18.11\",\"lessThan\":\"5.19\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/net/ethernet/intel/i40e/i40e_main.c\",\"drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.19\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.19\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.168\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.113\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.57\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.11.4\",\"lessThanOrEqual\":\"6.11.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.0,\"impactScore\":6.0},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-10-22T13:24:46.896116Z\",\"id\":\"CVE-2024-50041\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-401\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.15.54\",\"versionEndExcluding\":\"5.15.168\",\"matchCriteriaId\":\"D9429645-5F5B-486E-877E-5F2E0EB6202F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.18.11\",\"versionEndExcluding\":\"5.19\",\"matchCriteriaId\":\"3F904485-FC3F-4533-8CD9-B8208F0C4707\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.19\",\"versionEndExcluding\":\"6.1.113\",\"matchCriteriaId\":\"7D848431-3C7A-4C40-BC35-515047E89ABE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.57\",\"matchCriteriaId\":\"05D83DB8-7465-4F88-AFB2-980011992AC1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.11.4\",\"matchCriteriaId\":\"AA84D336-CE9A-4535-B901-1AD77EC17C34\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.12:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"7F361E1D-580F-4A2D-A509-7615F73167A1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.12:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"925478D0-3E3D-4E6F-ACD5-09F28D5DF82C\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/703c4d820b31bcadf465288d5746c53445f02a55\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/8831abff1bd5b6bc8224f0c0671f46fbd702b5b2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/9a9747288ba0a9ad4f5c9877f18dd245770ad64e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/9db6ce9e2738b05a3672aff4d42169cf3bb5a3e3\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/dac6c7b3d33756d6ce09f00a96ea2ecd79fae9fb\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-13T16:11:53+00:00",
      "cve": "CVE-2024-50041",
      "id": "CVE-2024-50041",
      "initial_release_date": "2024-10-21T00:00:00+00:00",
      "product_status:known_affected": "184",
      "product_status:known_not_affected": "14",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: i40e: Fix macvlan leak by synchronizing access to mac_filter_hash",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-50041.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-31T13:51:58Z",
      "cve": "CVE-2024-50041",
      "id": "CVE-2024-50041",
      "initial_release_date": "2024-10-22T02:49:56Z",
      "product_status:known_affected": "432",
      "product_status:known_not_affected": "328",
      "product_status:recommended": "638",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-50041",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-50041.json",
      "version": "68"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-11-03T22:24:48.319Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-50041\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-10-22T13:24:46.896116Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-10-22T13:24:50.058Z\"}}], \"cna\": {\"title\": \"i40e: Fix macvlan leak by synchronizing access to mac_filter_hash\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"ddec6cbbe22781d17965f1e6386e5a6363c058d2\", \"lessThan\": \"9db6ce9e2738b05a3672aff4d42169cf3bb5a3e3\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"fed0d9f13266a22ce1fc9a97521ef9cdc6271a23\", \"lessThan\": \"9a9747288ba0a9ad4f5c9877f18dd245770ad64e\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"fed0d9f13266a22ce1fc9a97521ef9cdc6271a23\", \"lessThan\": \"703c4d820b31bcadf465288d5746c53445f02a55\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"fed0d9f13266a22ce1fc9a97521ef9cdc6271a23\", \"lessThan\": \"8831abff1bd5b6bc8224f0c0671f46fbd702b5b2\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"fed0d9f13266a22ce1fc9a97521ef9cdc6271a23\", \"lessThan\": \"dac6c7b3d33756d6ce09f00a96ea2ecd79fae9fb\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"8bfcbaa379694e05290fcff21f4bd40afcf88776\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"5.15.54\", \"lessThan\": \"5.15.168\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"5.18.11\", \"lessThan\": \"5.19\", \"versionType\": \"semver\"}], \"programFiles\": [\"drivers/net/ethernet/intel/i40e/i40e_main.c\", \"drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.19\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.19\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.15.168\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.113\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.57\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.11.4\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.11.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/net/ethernet/intel/i40e/i40e_main.c\", \"drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/9db6ce9e2738b05a3672aff4d42169cf3bb5a3e3\"}, {\"url\": \"https://git.kernel.org/stable/c/9a9747288ba0a9ad4f5c9877f18dd245770ad64e\"}, {\"url\": \"https://git.kernel.org/stable/c/703c4d820b31bcadf465288d5746c53445f02a55\"}, {\"url\": \"https://git.kernel.org/stable/c/8831abff1bd5b6bc8224f0c0671f46fbd702b5b2\"}, {\"url\": \"https://git.kernel.org/stable/c/dac6c7b3d33756d6ce09f00a96ea2ecd79fae9fb\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ni40e: Fix macvlan leak by synchronizing access to mac_filter_hash\\n\\nThis patch addresses a macvlan leak issue in the i40e driver caused by\\nconcurrent access to vsi-\u003emac_filter_hash. The leak occurs when multiple\\nthreads attempt to modify the mac_filter_hash simultaneously, leading to\\ninconsistent state and potential memory leaks.\\n\\nTo fix this, we now wrap the calls to i40e_del_mac_filter() and zeroing\\nvf-\u003edefault_lan_addr.addr with spin_lock/unlock_bh(\u0026vsi-\u003emac_filter_hash_lock),\\nensuring atomic operations and preventing concurrent access.\\n\\nAdditionally, we add lockdep_assert_held(\u0026vsi-\u003emac_filter_hash_lock) in\\ni40e_add_mac_filter() to help catch similar issues in the future.\\n\\nReproduction steps:\\n1. Spawn VFs and configure port vlan on them.\\n2. Trigger concurrent macvlan operations (e.g., adding and deleting\\n\\tportvlan and/or mac filters).\\n3. Observe the potential memory leak and inconsistent state in the\\n\\tmac_filter_hash.\\n\\nThis synchronization ensures the integrity of the mac_filter_hash and prevents\\nthe described leak.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.168\", \"versionStartIncluding\": \"5.15.54\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.113\", \"versionStartIncluding\": \"5.19\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.57\", \"versionStartIncluding\": \"5.19\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.11.4\", \"versionStartIncluding\": \"5.19\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12\", \"versionStartIncluding\": \"5.19\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"5.18.11\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-05-23T15:54:18.482Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-50041\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-05-23T15:54:18.482Z\", \"dateReserved\": \"2024-10-21T12:17:06.071Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-10-21T19:39:40.435Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.