CVE-2024-46717 (GCVE-0-2024-46717)

Vulnerability from cvelistv5 – Published: 2024-09-18 06:32 – Updated: 2026-08-05 11:38
VLAI
Title
net/mlx5e: SHAMPO, Fix incorrect page release
Summary
In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: SHAMPO, Fix incorrect page release Under the following conditions: 1) No skb created yet 2) header_size == 0 (no SHAMPO header) 3) header_index + 1 % MLX5E_SHAMPO_WQ_HEADER_PER_PAGE == 0 (this is the last page fragment of a SHAMPO header page) a new skb is formed with a page that is NOT a SHAMPO header page (it is a regular data page). Further down in the same function (mlx5e_handle_rx_cqe_mpwrq_shampo()), a SHAMPO header page from header_index is released. This is wrong and it leads to SHAMPO header pages being released more than once.
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator (v2.0.3)
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 7957837b816f11eecb9146235bb0715478f4c81f , < 03924d117625ecb10ee3c9b65930bcb2c37ae629 (git)
Affected: 7957837b816f11eecb9146235bb0715478f4c81f , < ae9018e3f61ba5cc1f08a6e51d3c0bef0a79f3ab (git)
Affected: 7957837b816f11eecb9146235bb0715478f4c81f , < c909ab41df2b09cde919801c7a7b6bb2cc37ea22 (git)
Affected: 7957837b816f11eecb9146235bb0715478f4c81f , < 70bd03b89f20b9bbe51a7f73c4950565a17a45f7 (git)
Affected: a4161e4861132d5b324746a260283e87f2d65daf (git)
Affected: 5.16.6 , < 5.17 (semver)
Create a notification for this product.
Linux Linux Affected: 5.17
Unaffected: 0 , < 5.17 (semver)
Unaffected: 6.1.109 , ≤ 6.1.* (semver)
Unaffected: 6.6.50 , ≤ 6.6.* (semver)
Unaffected: 6.10.9 , ≤ 6.10.* (semver)
Unaffected: 6.11 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-46717",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-29T14:57:52.467181Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-29T14:58:07.696Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T22:16:49.634Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/mellanox/mlx5/core/en_rx.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "03924d117625ecb10ee3c9b65930bcb2c37ae629",
              "status": "affected",
              "version": "7957837b816f11eecb9146235bb0715478f4c81f",
              "versionType": "git"
            },
            {
              "lessThan": "ae9018e3f61ba5cc1f08a6e51d3c0bef0a79f3ab",
              "status": "affected",
              "version": "7957837b816f11eecb9146235bb0715478f4c81f",
              "versionType": "git"
            },
            {
              "lessThan": "c909ab41df2b09cde919801c7a7b6bb2cc37ea22",
              "status": "affected",
              "version": "7957837b816f11eecb9146235bb0715478f4c81f",
              "versionType": "git"
            },
            {
              "lessThan": "70bd03b89f20b9bbe51a7f73c4950565a17a45f7",
              "status": "affected",
              "version": "7957837b816f11eecb9146235bb0715478f4c81f",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "a4161e4861132d5b324746a260283e87f2d65daf",
              "versionType": "git"
            },
            {
              "lessThan": "5.17",
              "status": "affected",
              "version": "5.16.6",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/mellanox/mlx5/core/en_rx.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.17"
            },
            {
              "lessThan": "5.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.109",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.50",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.10.*",
              "status": "unaffected",
              "version": "6.10.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.11",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.109",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.50",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10.9",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.16.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: SHAMPO, Fix incorrect page release\n\nUnder the following conditions:\n1) No skb created yet\n2) header_size == 0 (no SHAMPO header)\n3) header_index + 1 % MLX5E_SHAMPO_WQ_HEADER_PER_PAGE == 0 (this is the\n   last page fragment of a SHAMPO header page)\n\na new skb is formed with a page that is NOT a SHAMPO header page (it\nis a regular data page). Further down in the same function\n(mlx5e_handle_rx_cqe_mpwrq_shampo()), a SHAMPO header page from\nheader_index is released. This is wrong and it leads to SHAMPO header\npages being released more than once."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The vulnerable code is the mlx5e RX completion handler, driven purely by inbound Ethernet/IP frames processed in NAPI softirq context; any remote host that can send packets to an mlx5 NIC (the standard NIC on internet-facing cloud, datacenter and HPC servers) reaches it. No local access or LAN adjacency is required since ordinary routed IP traffic produces the non-splittable-header CQEs that trigger the bug.\nAC:L - The attacker controls the entire packet stream and thus all three trigger conditions \u2014 no in-flight GRO skb, header_size == 0, and header_index landing on a page boundary (1 in every 16 entries) \u2014 so at any meaningful traffic rate the condition is hit continuously and repeatably, with no race or memory layout outside attacker influence. SHAMPO/HW-GRO must be enabled on the interface, but that is a common datacenter performance configuration rather than a rare kernel config.\nPR:N - The bug is hit in the driver receive path before any socket lookup, credential check, or authentication; the attacker needs no account, capability, or session on the target. Merely sending packets to the host\u0027s mlx5 interface is sufficient.\nUI:N - Exploitation requires only that the target receive packets on an mlx5 interface with HW-GRO active; no victim action of any kind is needed.\nS:U - The premature page release, double free, and DMA-into-freed-page all corrupt kernel memory within the same kernel security authority. No hypervisor, IOMMU, or sandbox boundary is crossed by the defect itself.\nC:H - The page-pool double-release causes pages still referenced by live skbs to be recycled and handed to other consumers, and pages reused for unrelated kernel allocations can be re-wrapped into skbs delivered to sockets, disclosing arbitrary kernel memory to a network reader. Any use-after-free of this kind gives a general read primitive.\nI:H - The NIC\u0027s header-buffer MKEY still maps the released page, so the device keeps DMA\u0027ing fully attacker-controlled packet-header bytes into memory that has been returned to the page pool and potentially reallocated for arbitrary kernel use, and the double free lets the same page be owned by two consumers. That is an attacker-controlled write into reused kernel memory, exploitable for control-flow hijack.\nA:H - The second release triggers a page_pool refcount underflow WARN_ON (panic under panic_on_warn) and a double free into the page pool, plus header-ring bitmap/pi-ci desync that wedges the RX queue, with the use-after-free itself producing oopses. The condition is remotely and repeatedly triggerable, so a crash is readily achievable."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:38:08.486Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/03924d117625ecb10ee3c9b65930bcb2c37ae629"
        },
        {
          "url": "https://git.kernel.org/stable/c/ae9018e3f61ba5cc1f08a6e51d3c0bef0a79f3ab"
        },
        {
          "url": "https://git.kernel.org/stable/c/c909ab41df2b09cde919801c7a7b6bb2cc37ea22"
        },
        {
          "url": "https://git.kernel.org/stable/c/70bd03b89f20b9bbe51a7f73c4950565a17a45f7"
        }
      ],
      "title": "net/mlx5e: SHAMPO, Fix incorrect page release",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-46717",
    "datePublished": "2024-09-18T06:32:16.791Z",
    "dateReserved": "2024-09-11T15:12:18.254Z",
    "dateUpdated": "2026-08-05T11:38:08.486Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-46717",
      "date": "2026-08-06",
      "epss": "0.00535",
      "percentile": "0.42165"
    },
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet/mlx5e: SHAMPO, Fix incorrect page release\\n\\nUnder the following conditions:\\n1) No skb created yet\\n2) header_size == 0 (no SHAMPO header)\\n3) header_index + 1 % MLX5E_SHAMPO_WQ_HEADER_PER_PAGE == 0 (this is the\\n   last page fragment of a SHAMPO header page)\\n\\na new skb is formed with a page that is NOT a SHAMPO header page (it\\nis a regular data page). Further down in the same function\\n(mlx5e_handle_rx_cqe_mpwrq_shampo()), a SHAMPO header page from\\nheader_index is released. This is wrong and it leads to SHAMPO header\\npages being released more than once.\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net/mlx5e: SHAMPO, Corregir liberaci\\u00f3n de p\\u00e1gina incorrecta Bajo las siguientes condiciones: 1) No se ha creado ning\\u00fan skb todav\\u00eda 2) header_size == 0 (no hay encabezado SHAMPO) 3) header_index + 1 % MLX5E_SHAMPO_WQ_HEADER_PER_PAGE == 0 (este es el \\u00faltimo fragmento de p\\u00e1gina de una p\\u00e1gina de encabezado SHAMPO) se forma un nuevo skb con una p\\u00e1gina que NO es una p\\u00e1gina de encabezado SHAMPO (es una p\\u00e1gina de datos normal). M\\u00e1s abajo en la misma funci\\u00f3n (mlx5e_handle_rx_cqe_mpwrq_shampo()), se libera una p\\u00e1gina de encabezado SHAMPO de header_index. Esto es incorrecto y lleva a que las p\\u00e1ginas de encabezado SHAMPO se liberen m\\u00e1s de una vez.\"}]",
      "id": "CVE-2024-46717",
      "lastModified": "2024-09-20T12:30:51.220",
      "published": "2024-09-18T07:15:03.237",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/03924d117625ecb10ee3c9b65930bcb2c37ae629\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/70bd03b89f20b9bbe51a7f73c4950565a17a45f7\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/ae9018e3f61ba5cc1f08a6e51d3c0bef0a79f3ab\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/c909ab41df2b09cde919801c7a7b6bb2cc37ea22\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Awaiting Analysis"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-46717\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-09-18T07:15:03.237\",\"lastModified\":\"2026-08-04T11:20:18.253\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet/mlx5e: SHAMPO, Fix incorrect page release\\n\\nUnder the following conditions:\\n1) No skb created yet\\n2) header_size == 0 (no SHAMPO header)\\n3) header_index + 1 % MLX5E_SHAMPO_WQ_HEADER_PER_PAGE == 0 (this is the\\n   last page fragment of a SHAMPO header page)\\n\\na new skb is formed with a page that is NOT a SHAMPO header page (it\\nis a regular data page). Further down in the same function\\n(mlx5e_handle_rx_cqe_mpwrq_shampo()), a SHAMPO header page from\\nheader_index is released. This is wrong and it leads to SHAMPO header\\npages being released more than once.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net/mlx5e: SHAMPO, Corregir liberaci\u00f3n de p\u00e1gina incorrecta Bajo las siguientes condiciones: 1) No se ha creado ning\u00fan skb todav\u00eda 2) header_size == 0 (no hay encabezado SHAMPO) 3) header_index + 1 % MLX5E_SHAMPO_WQ_HEADER_PER_PAGE == 0 (este es el \u00faltimo fragmento de p\u00e1gina de una p\u00e1gina de encabezado SHAMPO) se forma un nuevo skb con una p\u00e1gina que NO es una p\u00e1gina de encabezado SHAMPO (es una p\u00e1gina de datos normal). M\u00e1s abajo en la misma funci\u00f3n (mlx5e_handle_rx_cqe_mpwrq_shampo()), se libera una p\u00e1gina de encabezado SHAMPO de header_index. Esto es incorrecto y lleva a que las p\u00e1ginas de encabezado SHAMPO se liberen m\u00e1s de una vez.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/net/ethernet/mellanox/mlx5/core/en_rx.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"7957837b816f11eecb9146235bb0715478f4c81f\",\"lessThan\":\"03924d117625ecb10ee3c9b65930bcb2c37ae629\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"7957837b816f11eecb9146235bb0715478f4c81f\",\"lessThan\":\"ae9018e3f61ba5cc1f08a6e51d3c0bef0a79f3ab\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"7957837b816f11eecb9146235bb0715478f4c81f\",\"lessThan\":\"c909ab41df2b09cde919801c7a7b6bb2cc37ea22\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"7957837b816f11eecb9146235bb0715478f4c81f\",\"lessThan\":\"70bd03b89f20b9bbe51a7f73c4950565a17a45f7\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"a4161e4861132d5b324746a260283e87f2d65daf\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5.16.6\",\"lessThan\":\"5.17\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/net/ethernet/mellanox/mlx5/core/en_rx.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.17\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.17\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.109\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.50\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.10.9\",\"lessThanOrEqual\":\"6.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.11\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-09-29T14:57:52.467181Z\",\"id\":\"CVE-2024-46717\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"6.1.109\",\"matchCriteriaId\":\"EFD3BACD-EA1D-4437-A135-A3E7A761F54F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.50\",\"matchCriteriaId\":\"A56A0460-B122-44D6-B0E6-26CE9C891536\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.10.9\",\"matchCriteriaId\":\"F4469C96-A86B-4CC3-B2D5-C21B6B72641B\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/03924d117625ecb10ee3c9b65930bcb2c37ae629\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/70bd03b89f20b9bbe51a7f73c4950565a17a45f7\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ae9018e3f61ba5cc1f08a6e51d3c0bef0a79f3ab\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c909ab41df2b09cde919801c7a7b6bb2cc37ea22\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T18:03:05+00:00",
      "cve": "CVE-2024-46717",
      "id": "CVE-2024-46717",
      "initial_release_date": "2024-09-18T00:00:00+00:00",
      "product_status:known_affected": "184",
      "product_status:known_not_affected": "14",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: net/mlx5e: SHAMPO, Fix incorrect page release",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-46717.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-07-23T02:00:04Z",
      "cve": "CVE-2024-46717",
      "id": "CVE-2024-46717",
      "initial_release_date": "2024-09-19T03:11:11Z",
      "product_status:known_affected": "404",
      "product_status:known_not_affected": "209",
      "product_status:recommended": "657",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-46717",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-46717.json",
      "version": "56"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-11-03T22:16:49.634Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-46717\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-29T14:57:52.467181Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-29T14:57:56.549Z\"}}], \"cna\": {\"title\": \"net/mlx5e: SHAMPO, Fix incorrect page release\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"7957837b816f11eecb9146235bb0715478f4c81f\", \"lessThan\": \"03924d117625ecb10ee3c9b65930bcb2c37ae629\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"7957837b816f11eecb9146235bb0715478f4c81f\", \"lessThan\": \"ae9018e3f61ba5cc1f08a6e51d3c0bef0a79f3ab\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"7957837b816f11eecb9146235bb0715478f4c81f\", \"lessThan\": \"c909ab41df2b09cde919801c7a7b6bb2cc37ea22\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"7957837b816f11eecb9146235bb0715478f4c81f\", \"lessThan\": \"70bd03b89f20b9bbe51a7f73c4950565a17a45f7\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"a4161e4861132d5b324746a260283e87f2d65daf\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"5.16.6\", \"lessThan\": \"5.17\", \"versionType\": \"semver\"}], \"programFiles\": [\"drivers/net/ethernet/mellanox/mlx5/core/en_rx.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.17\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.17\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.1.109\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.50\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.10.9\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.10.*\"}, {\"status\": \"unaffected\", \"version\": \"6.11\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/net/ethernet/mellanox/mlx5/core/en_rx.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/03924d117625ecb10ee3c9b65930bcb2c37ae629\"}, {\"url\": \"https://git.kernel.org/stable/c/ae9018e3f61ba5cc1f08a6e51d3c0bef0a79f3ab\"}, {\"url\": \"https://git.kernel.org/stable/c/c909ab41df2b09cde919801c7a7b6bb2cc37ea22\"}, {\"url\": \"https://git.kernel.org/stable/c/70bd03b89f20b9bbe51a7f73c4950565a17a45f7\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet/mlx5e: SHAMPO, Fix incorrect page release\\n\\nUnder the following conditions:\\n1) No skb created yet\\n2) header_size == 0 (no SHAMPO header)\\n3) header_index + 1 % MLX5E_SHAMPO_WQ_HEADER_PER_PAGE == 0 (this is the\\n   last page fragment of a SHAMPO header page)\\n\\na new skb is formed with a page that is NOT a SHAMPO header page (it\\nis a regular data page). Further down in the same function\\n(mlx5e_handle_rx_cqe_mpwrq_shampo()), a SHAMPO header page from\\nheader_index is released. This is wrong and it leads to SHAMPO header\\npages being released more than once.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.109\", \"versionStartIncluding\": \"5.17\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.50\", \"versionStartIncluding\": \"5.17\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.10.9\", \"versionStartIncluding\": \"5.17\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.11\", \"versionStartIncluding\": \"5.17\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"5.16.6\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-05-23T15:53:27.973Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-46717\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-05-23T15:53:27.973Z\", \"dateReserved\": \"2024-09-11T15:12:18.254Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-09-18T06:32:16.791Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.