CVE-2024-27393 (GCVE-0-2024-27393)

Vulnerability from cvelistv5 – Published: 2024-05-09 16:37 – Updated: 2026-08-05 11:29
VLAI
Title
xen-netfront: Add missing skb_mark_for_recycle
Summary
In the Linux kernel, the following vulnerability has been resolved: xen-netfront: Add missing skb_mark_for_recycle Notice that skb_mark_for_recycle() is introduced later than fixes tag in commit 6a5bcd84e886 ("page_pool: Allow drivers to hint on SKB recycling"). It is believed that fixes tag were missing a call to page_pool_release_page() between v5.9 to v5.14, after which is should have used skb_mark_for_recycle(). Since v6.6 the call page_pool_release_page() were removed (in commit 535b9c61bdef ("net: page_pool: hide page_pool_release_page()") and remaining callers converted (in commit 6bfef2ec0172 ("Merge branch 'net-page_pool-remove-page_pool_release_page'")). This leak became visible in v6.8 via commit dba1b8a7ab68 ("mm/page_pool: catch page_pool memory leaks").
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 6c5aa6fc4defc2a0977a2c59e4710d50fa1e834c , < 4143b9479caa29bb2380f3620dcbe16ea84eb3b1 (git)
Affected: 6c5aa6fc4defc2a0977a2c59e4710d50fa1e834c , < 7c1250796b6c262b505a46192f4716b8c6a6a8c6 (git)
Affected: 6c5aa6fc4defc2a0977a2c59e4710d50fa1e834c , < 27aa3e4b3088426b7e34584274ad45b5afaf7629 (git)
Affected: 6c5aa6fc4defc2a0977a2c59e4710d50fa1e834c , < c8b7b2f158d9d4fb89cd2f68244af154f7549bb4 (git)
Affected: 6c5aa6fc4defc2a0977a2c59e4710d50fa1e834c , < 037965402a010898d34f4e35327d22c0a95cd51f (git)
Create a notification for this product.
Linux Linux Affected: 5.9
Unaffected: 0 , < 5.9 (semver)
Unaffected: 5.15.154 , ≤ 5.15.* (semver)
Unaffected: 6.1.85 , ≤ 6.1.* (semver)
Unaffected: 6.6.26 , ≤ 6.6.* (semver)
Unaffected: 6.8.5 , ≤ 6.8.* (semver)
Unaffected: 6.9 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 5.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-27393",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-31T18:36:32.425649Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "description": "CWE-noinfo Not enough information",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-04T18:49:42.053Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T00:34:52.268Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/4143b9479caa29bb2380f3620dcbe16ea84eb3b1"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/7c1250796b6c262b505a46192f4716b8c6a6a8c6"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/27aa3e4b3088426b7e34584274ad45b5afaf7629"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/c8b7b2f158d9d4fb89cd2f68244af154f7549bb4"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/037965402a010898d34f4e35327d22c0a95cd51f"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://xenbits.xen.org/xsa/advisory-457.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2024/05/08/4"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/xen-netfront.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "4143b9479caa29bb2380f3620dcbe16ea84eb3b1",
              "status": "affected",
              "version": "6c5aa6fc4defc2a0977a2c59e4710d50fa1e834c",
              "versionType": "git"
            },
            {
              "lessThan": "7c1250796b6c262b505a46192f4716b8c6a6a8c6",
              "status": "affected",
              "version": "6c5aa6fc4defc2a0977a2c59e4710d50fa1e834c",
              "versionType": "git"
            },
            {
              "lessThan": "27aa3e4b3088426b7e34584274ad45b5afaf7629",
              "status": "affected",
              "version": "6c5aa6fc4defc2a0977a2c59e4710d50fa1e834c",
              "versionType": "git"
            },
            {
              "lessThan": "c8b7b2f158d9d4fb89cd2f68244af154f7549bb4",
              "status": "affected",
              "version": "6c5aa6fc4defc2a0977a2c59e4710d50fa1e834c",
              "versionType": "git"
            },
            {
              "lessThan": "037965402a010898d34f4e35327d22c0a95cd51f",
              "status": "affected",
              "version": "6c5aa6fc4defc2a0977a2c59e4710d50fa1e834c",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/xen-netfront.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.9"
            },
            {
              "lessThan": "5.9",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.154",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.85",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.26",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.8.*",
              "status": "unaffected",
              "version": "6.8.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.9",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.154",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.85",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.26",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8.5",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxen-netfront: Add missing skb_mark_for_recycle\n\nNotice that skb_mark_for_recycle() is introduced later than fixes tag in\ncommit 6a5bcd84e886 (\"page_pool: Allow drivers to hint on SKB recycling\").\n\nIt is believed that fixes tag were missing a call to page_pool_release_page()\nbetween v5.9 to v5.14, after which is should have used skb_mark_for_recycle().\nSince v6.6 the call page_pool_release_page() were removed (in\ncommit 535b9c61bdef (\"net: page_pool: hide page_pool_release_page()\")\nand remaining callers converted (in commit 6bfef2ec0172 (\"Merge branch\n\u0027net-page_pool-remove-page_pool_release_page\u0027\")).\n\nThis leak became visible in v6.8 via commit dba1b8a7ab68 (\"mm/page_pool: catch\npage_pool memory leaks\")."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The defect is in the xen-netfront RX refill/release path, driven entirely by packets arriving from the network; every inbound frame causes a page_pool page to be released outside the pool, in NAPI context before any socket demux or firewall decision. Any remote host that can route a packet to the guest reaches the vulnerable code.\nAC:L - There is no race, no memory-layout requirement, and no state the attacker cannot influence \u2014 the mishandling is deterministic for every single received packet, and the amplifying `check_pages_enabled` gate is on by default via CONFIG_INIT_ON_ALLOC_DEFAULT_ON on mainstream distributions. Simply sending traffic triggers it reliably.\nPR:N - The leak occurs in the driver receive path before any authentication, socket lookup, or filtering, so an entirely unauthenticated remote sender triggers it. No account, session, or local foothold on the guest is required.\nUI:N - No victim action is needed; the vulnerable path executes automatically whenever the guest\u0027s network interface receives frames. The interface is up and receiving by definition on any networked Xen guest.\nS:U - The leaked pages and the stalled page_pool are guest kernel resources, and the pool is created with .flags = 0 so no DMA/IOMMU mappings are left dangling; grant references are properly ended before the skb is handed up. Impact stays within the guest\u0027s own security authority, with no crossing into the hypervisor or dom0.\nC:N - There is no out-of-bounds or use-after-free read \u2014 pages are either quarantined by bad_page() or freed normally, and pp_magic aliases page-\u003elru which is overwritten before reuse. No kernel data is disclosed to the attacker.\nI:N - Nothing is written out of bounds or after free; the only state affected is the page_pool\u0027s own inflight accounting and pages being withheld from the allocator. There is no write primitive and no path to control-flow hijacking.\nA:H - On any kernel with check_pages_enabled (CONFIG_DEBUG_VM, debug_pagealloc, or the widely shipped init_on_alloc/init_on_free hardening defaults), free_pages_prepare() rejects each RX page so 4 KB is permanently lost per received packet \u2014 an unbounded, remotely driven memory exhaustion leading to OOM kill and system death, plus tainting dmesg floods. Even without that gate, every device teardown/resume permanently leaks the page_pool with an endlessly rearming work item and \"stalled pool shutdown\" warnings."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:29:27.055Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/4143b9479caa29bb2380f3620dcbe16ea84eb3b1"
        },
        {
          "url": "https://git.kernel.org/stable/c/7c1250796b6c262b505a46192f4716b8c6a6a8c6"
        },
        {
          "url": "https://git.kernel.org/stable/c/27aa3e4b3088426b7e34584274ad45b5afaf7629"
        },
        {
          "url": "https://git.kernel.org/stable/c/c8b7b2f158d9d4fb89cd2f68244af154f7549bb4"
        },
        {
          "url": "https://git.kernel.org/stable/c/037965402a010898d34f4e35327d22c0a95cd51f"
        }
      ],
      "title": "xen-netfront: Add missing skb_mark_for_recycle",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-27393",
    "datePublished": "2024-05-09T16:37:07.973Z",
    "dateReserved": "2024-02-25T13:47:42.677Z",
    "dateUpdated": "2026-08-05T11:29:27.055Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-27393",
      "date": "2026-08-10",
      "epss": "0.00772",
      "percentile": "0.52256"
    },
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nxen-netfront: Add missing skb_mark_for_recycle\\n\\nNotice that skb_mark_for_recycle() is introduced later than fixes tag in\\ncommit 6a5bcd84e886 (\\\"page_pool: Allow drivers to hint on SKB recycling\\\").\\n\\nIt is believed that fixes tag were missing a call to page_pool_release_page()\\nbetween v5.9 to v5.14, after which is should have used skb_mark_for_recycle().\\nSince v6.6 the call page_pool_release_page() were removed (in\\ncommit 535b9c61bdef (\\\"net: page_pool: hide page_pool_release_page()\\\")\\nand remaining callers converted (in commit 6bfef2ec0172 (\\\"Merge branch\\n\u0027net-page_pool-remove-page_pool_release_page\u0027\\\")).\\n\\nThis leak became visible in v6.8 via commit dba1b8a7ab68 (\\\"mm/page_pool: catch\\npage_pool memory leaks\\\").\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se resolvi\\u00f3 la siguiente vulnerabilidad: xen-netfront: agrega skb_mark_for_recycle faltante. Tenga en cuenta que skb_mark_for_recycle() se introduce m\\u00e1s tarde que la etiqueta de correcci\\u00f3n en el commit 6a5bcd84e886 (\\\"page_pool: permitir que los controladores indiquen el reciclaje de SKB\\\"). Se cree que a la etiqueta de correcciones le faltaba una llamada a page_pool_release_page() entre v5.9 y v5.14, despu\\u00e9s de lo cual deber\\u00eda haber usado skb_mark_for_recycle(). Desde v6.6, la llamada page_pool_release_page() se elimin\\u00f3 (en el commit 535b9c61bdef (\\\"net: page_pool: hide page_pool_release_page()\\\") y las personas que llaman restantes se convirtieron (en el commit 6bfef2ec0172 (\\\"Merge Branch \u0027net-page_pool-remove-page_pool_release_page\u0027\\\") ). Esta fuga se hizo visible en la versi\\u00f3n 6.8 mediante el commit dba1b8a7ab68 (\\\"mm/page_pool: captura p\\u00e9rdidas de memoria en page_pool\\\").\"}]",
      "id": "CVE-2024-27393",
      "lastModified": "2024-11-21T09:04:31.160",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"baseScore\": 5.5, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 3.6}]}",
      "published": "2024-05-14T15:12:26.993",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/037965402a010898d34f4e35327d22c0a95cd51f\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/27aa3e4b3088426b7e34584274ad45b5afaf7629\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/4143b9479caa29bb2380f3620dcbe16ea84eb3b1\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/7c1250796b6c262b505a46192f4716b8c6a6a8c6\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/c8b7b2f158d9d4fb89cd2f68244af154f7549bb4\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"http://www.openwall.com/lists/oss-security/2024/05/08/4\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://xenbits.xen.org/xsa/advisory-457.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/037965402a010898d34f4e35327d22c0a95cd51f\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/27aa3e4b3088426b7e34584274ad45b5afaf7629\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/4143b9479caa29bb2380f3620dcbe16ea84eb3b1\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/7c1250796b6c262b505a46192f4716b8c6a6a8c6\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/c8b7b2f158d9d4fb89cd2f68244af154f7549bb4\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Awaiting Analysis"
    },
    "microsoft_vex": {
      "current_release_date": "2024-11-05T00:00:00.000Z",
      "cve": "CVE-2024-27393",
      "id": "msrc_CVE-2024-27393",
      "initial_release_date": "2024-05-02T07:00:00.000Z",
      "product_status:fixed": "2",
      "product_status:known_affected": "2",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "xen-netfront: Add missing skb_mark_for_recycle",
      "url": "https://msrc.microsoft.com/csaf/vex/2024/msrc_cve-2024-27393.json",
      "version": "2"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-27393\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-05-14T15:12:26.993\",\"lastModified\":\"2026-08-04T11:17:42.130\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nxen-netfront: Add missing skb_mark_for_recycle\\n\\nNotice that skb_mark_for_recycle() is introduced later than fixes tag in\\ncommit 6a5bcd84e886 (\\\"page_pool: Allow drivers to hint on SKB recycling\\\").\\n\\nIt is believed that fixes tag were missing a call to page_pool_release_page()\\nbetween v5.9 to v5.14, after which is should have used skb_mark_for_recycle().\\nSince v6.6 the call page_pool_release_page() were removed (in\\ncommit 535b9c61bdef (\\\"net: page_pool: hide page_pool_release_page()\\\")\\nand remaining callers converted (in commit 6bfef2ec0172 (\\\"Merge branch\\n\u0027net-page_pool-remove-page_pool_release_page\u0027\\\")).\\n\\nThis leak became visible in v6.8 via commit dba1b8a7ab68 (\\\"mm/page_pool: catch\\npage_pool memory leaks\\\").\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: xen-netfront: agrega skb_mark_for_recycle faltante. Tenga en cuenta que skb_mark_for_recycle() se introduce m\u00e1s tarde que la etiqueta de correcci\u00f3n en el commit 6a5bcd84e886 (\\\"page_pool: permitir que los controladores indiquen el reciclaje de SKB\\\"). Se cree que a la etiqueta de correcciones le faltaba una llamada a page_pool_release_page() entre v5.9 y v5.14, despu\u00e9s de lo cual deber\u00eda haber usado skb_mark_for_recycle(). Desde v6.6, la llamada page_pool_release_page() se elimin\u00f3 (en el commit 535b9c61bdef (\\\"net: page_pool: hide page_pool_release_page()\\\") y las personas que llaman restantes se convirtieron (en el commit 6bfef2ec0172 (\\\"Merge Branch \u0027net-page_pool-remove-page_pool_release_page\u0027\\\") ). Esta fuga se hizo visible en la versi\u00f3n 6.8 mediante el commit dba1b8a7ab68 (\\\"mm/page_pool: captura p\u00e9rdidas de memoria en page_pool\\\").\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/net/xen-netfront.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6c5aa6fc4defc2a0977a2c59e4710d50fa1e834c\",\"lessThan\":\"4143b9479caa29bb2380f3620dcbe16ea84eb3b1\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6c5aa6fc4defc2a0977a2c59e4710d50fa1e834c\",\"lessThan\":\"7c1250796b6c262b505a46192f4716b8c6a6a8c6\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6c5aa6fc4defc2a0977a2c59e4710d50fa1e834c\",\"lessThan\":\"27aa3e4b3088426b7e34584274ad45b5afaf7629\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6c5aa6fc4defc2a0977a2c59e4710d50fa1e834c\",\"lessThan\":\"c8b7b2f158d9d4fb89cd2f68244af154f7549bb4\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6c5aa6fc4defc2a0977a2c59e4710d50fa1e834c\",\"lessThan\":\"037965402a010898d34f4e35327d22c0a95cd51f\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/net/xen-netfront.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.9\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.9\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.154\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.85\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.26\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.8.5\",\"lessThanOrEqual\":\"6.8.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.9\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-05-31T18:36:32.425649Z\",\"id\":\"CVE-2024-27393\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-401\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.9\",\"versionEndExcluding\":\"5.15.154\",\"matchCriteriaId\":\"15E220AB-9386-4168-BA23-71607F895ECA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.85\",\"matchCriteriaId\":\"325665BF-2409-49D9-B391-39AD4566FDBD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.26\",\"matchCriteriaId\":\"C520696A-A594-4FFC-A32D-12DA535CE911\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.8.5\",\"matchCriteriaId\":\"DBD6C99E-4250-4DFE-8447-FF2075939D10\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.9:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"22BEDD49-2C6D-402D-9DBF-6646F6ECD10B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.9:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"DF73CB2A-DFFD-46FB-9BFE-AA394F27EA37\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/037965402a010898d34f4e35327d22c0a95cd51f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/27aa3e4b3088426b7e34584274ad45b5afaf7629\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/4143b9479caa29bb2380f3620dcbe16ea84eb3b1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/7c1250796b6c262b505a46192f4716b8c6a6a8c6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c8b7b2f158d9d4fb89cd2f68244af154f7549bb4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"http://www.openwall.com/lists/oss-security/2024/05/08/4\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"http://xenbits.xen.org/xsa/advisory-457.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://git.kernel.org/stable/c/037965402a010898d34f4e35327d22c0a95cd51f\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/27aa3e4b3088426b7e34584274ad45b5afaf7629\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/4143b9479caa29bb2380f3620dcbe16ea84eb3b1\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/7c1250796b6c262b505a46192f4716b8c6a6a8c6\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c8b7b2f158d9d4fb89cd2f68244af154f7549bb4\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2025-11-21T14:42:53+00:00",
      "cve": "CVE-2024-27393",
      "id": "CVE-2024-27393",
      "initial_release_date": "2024-05-08T00:00:00+00:00",
      "product_status:fixed": "1525",
      "product_status:known_affected": "64",
      "product_status:known_not_affected": "103",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: xen-netfront: Add missing skb_mark_for_recycle",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-27393.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-07-26T16:46:01Z",
      "cve": "CVE-2024-27393",
      "id": "CVE-2024-27393",
      "initial_release_date": "2024-05-10T02:59:17Z",
      "product_status:known_affected": "523",
      "product_status:known_not_affected": "37",
      "product_status:recommended": "621",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-27393",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-27393.json",
      "version": "87"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/4143b9479caa29bb2380f3620dcbe16ea84eb3b1\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/7c1250796b6c262b505a46192f4716b8c6a6a8c6\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/27aa3e4b3088426b7e34584274ad45b5afaf7629\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/c8b7b2f158d9d4fb89cd2f68244af154f7549bb4\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/037965402a010898d34f4e35327d22c0a95cd51f\", \"tags\": [\"x_transferred\"]}, {\"url\": \"http://xenbits.xen.org/xsa/advisory-457.html\", \"tags\": [\"x_transferred\"]}, {\"url\": \"http://www.openwall.com/lists/oss-security/2024/05/08/4\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T00:34:52.268Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.5, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"NONE\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-27393\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-05-31T18:36:32.425649Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"description\": \"CWE-noinfo Not enough information\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-05-31T18:36:36.639Z\"}}], \"cna\": {\"title\": \"xen-netfront: Add missing skb_mark_for_recycle\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.5, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:N - The defect is in the xen-netfront RX refill/release path, driven entirely by packets arriving from the network; every inbound frame causes a page_pool page to be released outside the pool, in NAPI context before any socket demux or firewall decision. Any remote host that can route a packet to the guest reaches the vulnerable code.\\nAC:L - There is no race, no memory-layout requirement, and no state the attacker cannot influence \\u2014 the mishandling is deterministic for every single received packet, and the amplifying `check_pages_enabled` gate is on by default via CONFIG_INIT_ON_ALLOC_DEFAULT_ON on mainstream distributions. Simply sending traffic triggers it reliably.\\nPR:N - The leak occurs in the driver receive path before any authentication, socket lookup, or filtering, so an entirely unauthenticated remote sender triggers it. No account, session, or local foothold on the guest is required.\\nUI:N - No victim action is needed; the vulnerable path executes automatically whenever the guest\u0027s network interface receives frames. The interface is up and receiving by definition on any networked Xen guest.\\nS:U - The leaked pages and the stalled page_pool are guest kernel resources, and the pool is created with .flags = 0 so no DMA/IOMMU mappings are left dangling; grant references are properly ended before the skb is handed up. Impact stays within the guest\u0027s own security authority, with no crossing into the hypervisor or dom0.\\nC:N - There is no out-of-bounds or use-after-free read \\u2014 pages are either quarantined by bad_page() or freed normally, and pp_magic aliases page-\u003elru which is overwritten before reuse. No kernel data is disclosed to the attacker.\\nI:N - Nothing is written out of bounds or after free; the only state affected is the page_pool\u0027s own inflight accounting and pages being withheld from the allocator. There is no write primitive and no path to control-flow hijacking.\\nA:H - On any kernel with check_pages_enabled (CONFIG_DEBUG_VM, debug_pagealloc, or the widely shipped init_on_alloc/init_on_free hardening defaults), free_pages_prepare() rejects each RX page so 4 KB is permanently lost per received packet \\u2014 an unbounded, remotely driven memory exhaustion leading to OOM kill and system death, plus tainting dmesg floods. Even without that gate, every device teardown/resume permanently leaks the page_pool with an endlessly rearming work item and \\\"stalled pool shutdown\\\" warnings.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6c5aa6fc4defc2a0977a2c59e4710d50fa1e834c\", \"lessThan\": \"4143b9479caa29bb2380f3620dcbe16ea84eb3b1\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"6c5aa6fc4defc2a0977a2c59e4710d50fa1e834c\", \"lessThan\": \"7c1250796b6c262b505a46192f4716b8c6a6a8c6\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"6c5aa6fc4defc2a0977a2c59e4710d50fa1e834c\", \"lessThan\": \"27aa3e4b3088426b7e34584274ad45b5afaf7629\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"6c5aa6fc4defc2a0977a2c59e4710d50fa1e834c\", \"lessThan\": \"c8b7b2f158d9d4fb89cd2f68244af154f7549bb4\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"6c5aa6fc4defc2a0977a2c59e4710d50fa1e834c\", \"lessThan\": \"037965402a010898d34f4e35327d22c0a95cd51f\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/net/xen-netfront.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.9\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.9\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.15.154\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.85\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.26\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.8.5\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.8.*\"}, {\"status\": \"unaffected\", \"version\": \"6.9\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/net/xen-netfront.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/4143b9479caa29bb2380f3620dcbe16ea84eb3b1\"}, {\"url\": \"https://git.kernel.org/stable/c/7c1250796b6c262b505a46192f4716b8c6a6a8c6\"}, {\"url\": \"https://git.kernel.org/stable/c/27aa3e4b3088426b7e34584274ad45b5afaf7629\"}, {\"url\": \"https://git.kernel.org/stable/c/c8b7b2f158d9d4fb89cd2f68244af154f7549bb4\"}, {\"url\": \"https://git.kernel.org/stable/c/037965402a010898d34f4e35327d22c0a95cd51f\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nxen-netfront: Add missing skb_mark_for_recycle\\n\\nNotice that skb_mark_for_recycle() is introduced later than fixes tag in\\ncommit 6a5bcd84e886 (\\\"page_pool: Allow drivers to hint on SKB recycling\\\").\\n\\nIt is believed that fixes tag were missing a call to page_pool_release_page()\\nbetween v5.9 to v5.14, after which is should have used skb_mark_for_recycle().\\nSince v6.6 the call page_pool_release_page() were removed (in\\ncommit 535b9c61bdef (\\\"net: page_pool: hide page_pool_release_page()\\\")\\nand remaining callers converted (in commit 6bfef2ec0172 (\\\"Merge branch\\n\u0027net-page_pool-remove-page_pool_release_page\u0027\\\")).\\n\\nThis leak became visible in v6.8 via commit dba1b8a7ab68 (\\\"mm/page_pool: catch\\npage_pool memory leaks\\\").\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.154\", \"versionStartIncluding\": \"5.9\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.85\", \"versionStartIncluding\": \"5.9\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.26\", \"versionStartIncluding\": \"5.9\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.8.5\", \"versionStartIncluding\": \"5.9\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.9\", \"versionStartIncluding\": \"5.9\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:29:27.055Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-27393\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:29:27.055Z\", \"dateReserved\": \"2024-02-25T13:47:42.677Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-05-09T16:37:07.973Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.