[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"repo-stars":3,"vuln-DEBIAN-CVE-2024-57996":6},{"stargazers_count":4,"fetched_at":5},7,"2026-06-04T08:53:30.047Z",{"id":7,"descriptions":8,"cisa":9,"weaknesses":10,"exploits":11,"aliases":12,"duplicate_of":9,"upstream":13,"downstream":16,"duplicates":21,"related":22,"reserved_at":9,"published_at":23,"modified_at":24,"state":9,"summary":25,"references_raw":27,"kevs":34,"epss":9,"epss_history":35,"metrics":36,"affected":43},"DEBIAN-CVE-2024-57996","In the Linux kernel, the following vulnerability has been resolved:  net_sched: sch_sfq: don't allow 1 packet limit  The current implementation does not work correctly with a limit of 1. iproute2 actually checks for this and this patch adds the check in kernel as well.  This fixes the following syzkaller reported crash:  UBSAN: array-index-out-of-bounds in net/sched/sch_sfq.c:210:6 index 65535 is out of range for type 'struct sfq_head[128]' CPU: 0 PID: 2569 Comm: syz-executor101 Not tainted 5.10.0-smp-DEV #1 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Call Trace:   __dump_stack lib/dump_stack.c:79 [inline]   dump_stack+0x125/0x19f lib/dump_stack.c:120   ubsan_epilogue lib/ubsan.c:148 [inline]   __ubsan_handle_out_of_bounds+0xed/0x120 lib/ubsan.c:347   sfq_link net/sched/sch_sfq.c:210 [inline]   sfq_dec+0x528/0x600 net/sched/sch_sfq.c:238   sfq_dequeue+0x39b/0x9d0 net/sched/sch_sfq.c:500   sfq_reset+0x13/0x50 net/sched/sch_sfq.c:525   qdisc_reset+0xfe/0x510 net/sched/sch_generic.c:1026   tbf_reset+0x3d/0x100 net/sched/sch_tbf.c:319   qdisc_reset+0xfe/0x510 net/sched/sch_generic.c:1026   dev_reset_queue+0x8c/0x140 net/sched/sch_generic.c:1296   netdev_for_each_tx_queue include/linux/netdevice.h:2350 [inline]   dev_deactivate_many+0x6dc/0xc20 net/sched/sch_generic.c:1362   __dev_close_many+0x214/0x350 net/core/dev.c:1468   dev_close_many+0x207/0x510 net/core/dev.c:1506   unregister_netdevice_many+0x40f/0x16b0 net/core/dev.c:10738   unregister_netdevice_queue+0x2be/0x310 net/core/dev.c:10695   unregister_netdevice include/linux/netdevice.h:2893 [inline]   __tun_detach+0x6b6/0x1600 drivers/net/tun.c:689   tun_detach drivers/net/tun.c:705 [inline]   tun_chr_close+0x104/0x1b0 drivers/net/tun.c:3640   __fput+0x203/0x840 fs/file_table.c:280   task_work_run+0x129/0x1b0 kernel/task_work.c:185   exit_task_work include/linux/task_work.h:33 [inline]   do_exit+0x5ce/0x2200 kernel/exit.c:931   do_group_exit+0x144/0x310 kernel/exit.c:1046   __do_sys_exit_group kernel/exit.c:1057 [inline]   __se_sys_exit_group kernel/exit.c:1055 [inline]   __x64_sys_exit_group+0x3b/0x40 kernel/exit.c:1055  do_syscall_64+0x6c/0xd0  entry_SYSCALL_64_after_hwframe+0x61/0xcb RIP: 0033:0x7fe5e7b52479 Code: Unable to access opcode bytes at RIP 0x7fe5e7b5244f. RSP: 002b:00007ffd3c800398 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fe5e7b52479 RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000000 RBP: 00007fe5e7bcd2d0 R08: ffffffffffffffb8 R09: 0000000000000014 R10: 0000000000000000 R11: 0000000000000246 R12: 00007fe5e7bcd2d0 R13: 0000000000000000 R14: 00007fe5e7bcdd20 R15: 00007fe5e7b24270  The crash can be also be reproduced with the following (with a tc recompiled to allow for sfq limits of 1):  tc qdisc add dev dummy0 handle 1: root tbf rate 1Kbit burst 100b lat 1s ../iproute2-6.9.0/tc/tc qdisc add dev dummy0 handle 2: parent 1:10 sfq limit 1 ifconfig dummy0 up ping -I dummy0 -f -c2 -W0.1 8.8.8.8 sleep 1  Scenario that triggers the crash:  * the first packet is sent and queued in TBF and SFQ; qdisc qlen is 1  * TBF dequeues: it peeks from SFQ which moves the packet to the   gso_skb list and keeps qdisc qlen set to 1. TBF is out of tokens so   it schedules itself for later.  * the second packet is sent and TBF tries to queues it to SFQ. qdisc   qlen is now 2 and because the SFQ limit is 1 the packet is dropped   by SFQ. At this point qlen is 1, and all of the SFQ slots are empty,   however q->tail is not NULL.  At this point, assuming no more packets are queued, when sch_dequeue runs again it will decrement the qlen for the current empty slot causing an underflow and the subsequent out of bounds access.",null,[],[],[],[14],{"_key":15},"CVE-2024-57996",[17,19],{"_key":18},"DLA-4102-1",{"_key":20},"DLA-4327-1",[],[],"2025-02-27T02:15:13.620Z","2026-04-28T20:30:13.485793Z",{"cisa_kev":26,"cisa_ransomware":26,"cisa_vendor":9,"epss_severity":9,"epss_score":9,"severity":9,"severity_score":9,"severity_version":9,"severity_source":9,"severity_vector":9,"severity_status":9},false,[28],{"url":29,"sources":30,"tags":32},"https://security-tracker.debian.org/tracker/CVE-2024-57996",[31],"osv_debian",[33],"Advisory",[],[],[37],{"source":31,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":38,"cvss_v4_0":9},{"baseScore":39,"baseSeverity":9,"vectorString":40,"impactScore":41,"exploitabilityScore":42},5.5,"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",6,4.6,[44,63],{"ecosystem":45,"name":46,"vendor":47,"product":46,"cpe_part":9,"purl_type":48,"purl_namespace":47,"purl_name":46,"source":9,"versions":49},"Debian","linux","debian","deb",[50,56,59,62],{"version":51,"is_range":52,"range_type":53,"version_start":9,"version_start_type":9,"version_end":54,"version_end_type":55,"fixed_in":9},"lt5_10_244_1",true,"ecosystem","5.10.244-1","excluding",{"version":57,"is_range":52,"range_type":53,"version_start":9,"version_start_type":9,"version_end":58,"version_end_type":55,"fixed_in":9},"lt6_1_129_1","6.1.129-1",{"version":60,"is_range":52,"range_type":53,"version_start":9,"version_start_type":9,"version_end":61,"version_end_type":55,"fixed_in":9},"lt6_12_13_1","6.12.13-1",{"version":60,"is_range":52,"range_type":53,"version_start":9,"version_start_type":9,"version_end":61,"version_end_type":55,"fixed_in":9},{"ecosystem":45,"name":64,"vendor":47,"product":64,"cpe_part":9,"purl_type":48,"purl_namespace":47,"purl_name":64,"source":9,"versions":65},"linux-6.1",[66],{"version":67,"is_range":52,"range_type":53,"version_start":9,"version_start_type":9,"version_end":68,"version_end_type":55,"fixed_in":9},"lt6_1_129_1~deb11u1","6.1.129-1~deb11u1"]