CVE-2024-44984 (GCVE-0-2024-44984)

Vulnerability from cvelistv5 – Published: 2024-09-04 19:54 – Updated: 2026-08-05 11:37
VLAI
Title
bnxt_en: Fix double DMA unmapping for XDP_REDIRECT
Summary
In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Fix double DMA unmapping for XDP_REDIRECT Remove the dma_unmap_page_attrs() call in the driver's XDP_REDIRECT code path. This should have been removed when we let the page pool handle the DMA mapping. This bug causes the warning: WARNING: CPU: 7 PID: 59 at drivers/iommu/dma-iommu.c:1198 iommu_dma_unmap_page+0xd5/0x100 CPU: 7 PID: 59 Comm: ksoftirqd/7 Tainted: G W 6.8.0-1010-gcp #11-Ubuntu Hardware name: Dell Inc. PowerEdge R7525/0PYVT1, BIOS 2.15.2 04/02/2024 RIP: 0010:iommu_dma_unmap_page+0xd5/0x100 Code: 89 ee 48 89 df e8 cb f2 69 ff 48 83 c4 08 5b 41 5c 41 5d 41 5e 41 5f 5d 31 c0 31 d2 31 c9 31 f6 31 ff 45 31 c0 e9 ab 17 71 00 <0f> 0b 48 83 c4 08 5b 41 5c 41 5d 41 5e 41 5f 5d 31 c0 31 d2 31 c9 RSP: 0018:ffffab1fc0597a48 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffff99ff838280c8 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffffab1fc0597a78 R08: 0000000000000002 R09: ffffab1fc0597c1c R10: ffffab1fc0597cd3 R11: ffff99ffe375acd8 R12: 00000000e65b9000 R13: 0000000000000050 R14: 0000000000001000 R15: 0000000000000002 FS: 0000000000000000(0000) GS:ffff9a06efb80000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000565c34c37210 CR3: 00000005c7e3e000 CR4: 0000000000350ef0 ? show_regs+0x6d/0x80 ? __warn+0x89/0x150 ? iommu_dma_unmap_page+0xd5/0x100 ? report_bug+0x16a/0x190 ? handle_bug+0x51/0xa0 ? exc_invalid_op+0x18/0x80 ? iommu_dma_unmap_page+0xd5/0x100 ? iommu_dma_unmap_page+0x35/0x100 dma_unmap_page_attrs+0x55/0x220 ? bpf_prog_4d7e87c0d30db711_xdp_dispatcher+0x64/0x9f bnxt_rx_xdp+0x237/0x520 [bnxt_en] bnxt_rx_pkt+0x640/0xdd0 [bnxt_en] __bnxt_poll_work+0x1a1/0x3d0 [bnxt_en] bnxt_poll+0xaa/0x1e0 [bnxt_en] __napi_poll+0x33/0x1e0 net_rx_action+0x18a/0x2f0
Severity
10 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 578fcfd26e2a1d0e687b347057959228567e2af8 , < fa4e6ae38574d0fc5596272bee64727d8ab7052b (git)
Affected: 578fcfd26e2a1d0e687b347057959228567e2af8 , < 95a305ba259b685780ed62ea2295aa2feb2d6c0c (git)
Affected: 578fcfd26e2a1d0e687b347057959228567e2af8 , < 8baeef7616d5194045c5a6b97fd1246b87c55b13 (git)
Create a notification for this product.
Linux Linux Affected: 6.6
Unaffected: 0 , < 6.6 (semver)
Unaffected: 6.6.48 , ≤ 6.6.* (semver)
Unaffected: 6.10.7 , ≤ 6.10.* (semver)
Unaffected: 6.11 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "fa4e6ae38574d0fc5596272bee64727d8ab7052b",
              "status": "affected",
              "version": "578fcfd26e2a1d0e687b347057959228567e2af8",
              "versionType": "git"
            },
            {
              "lessThan": "95a305ba259b685780ed62ea2295aa2feb2d6c0c",
              "status": "affected",
              "version": "578fcfd26e2a1d0e687b347057959228567e2af8",
              "versionType": "git"
            },
            {
              "lessThan": "8baeef7616d5194045c5a6b97fd1246b87c55b13",
              "status": "affected",
              "version": "578fcfd26e2a1d0e687b347057959228567e2af8",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.6"
            },
            {
              "lessThan": "6.6",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.48",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.10.*",
              "status": "unaffected",
              "version": "6.10.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.11",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.48",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10.7",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbnxt_en: Fix double DMA unmapping for XDP_REDIRECT\n\nRemove the dma_unmap_page_attrs() call in the driver\u0027s XDP_REDIRECT\ncode path.  This should have been removed when we let the page pool\nhandle the DMA mapping.  This bug causes the warning:\n\nWARNING: CPU: 7 PID: 59 at drivers/iommu/dma-iommu.c:1198 iommu_dma_unmap_page+0xd5/0x100\nCPU: 7 PID: 59 Comm: ksoftirqd/7 Tainted: G        W          6.8.0-1010-gcp #11-Ubuntu\nHardware name: Dell Inc. PowerEdge R7525/0PYVT1, BIOS 2.15.2 04/02/2024\nRIP: 0010:iommu_dma_unmap_page+0xd5/0x100\nCode: 89 ee 48 89 df e8 cb f2 69 ff 48 83 c4 08 5b 41 5c 41 5d 41 5e 41 5f 5d 31 c0 31 d2 31 c9 31 f6 31 ff 45 31 c0 e9 ab 17 71 00 \u003c0f\u003e 0b 48 83 c4 08 5b 41 5c 41 5d 41 5e 41 5f 5d 31 c0 31 d2 31 c9\nRSP: 0018:ffffab1fc0597a48 EFLAGS: 00010246\nRAX: 0000000000000000 RBX: ffff99ff838280c8 RCX: 0000000000000000\nRDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000\nRBP: ffffab1fc0597a78 R08: 0000000000000002 R09: ffffab1fc0597c1c\nR10: ffffab1fc0597cd3 R11: ffff99ffe375acd8 R12: 00000000e65b9000\nR13: 0000000000000050 R14: 0000000000001000 R15: 0000000000000002\nFS:  0000000000000000(0000) GS:ffff9a06efb80000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000565c34c37210 CR3: 00000005c7e3e000 CR4: 0000000000350ef0\n? show_regs+0x6d/0x80\n? __warn+0x89/0x150\n? iommu_dma_unmap_page+0xd5/0x100\n? report_bug+0x16a/0x190\n? handle_bug+0x51/0xa0\n? exc_invalid_op+0x18/0x80\n? iommu_dma_unmap_page+0xd5/0x100\n? iommu_dma_unmap_page+0x35/0x100\ndma_unmap_page_attrs+0x55/0x220\n? bpf_prog_4d7e87c0d30db711_xdp_dispatcher+0x64/0x9f\nbnxt_rx_xdp+0x237/0x520 [bnxt_en]\nbnxt_rx_pkt+0x640/0xdd0 [bnxt_en]\n__bnxt_poll_work+0x1a1/0x3d0 [bnxt_en]\nbnxt_poll+0xaa/0x1e0 [bnxt_en]\n__napi_poll+0x33/0x1e0\nnet_rx_action+0x18a/0x2f0"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 10,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The defect is triggered entirely from the NIC receive path (`bnxt_poll` \u2192 `bnxt_rx_pkt` \u2192 `bnxt_rx_xdp`) by frames arriving on the wire, with no local access required. The canonical XDP_REDIRECT deployment is an internet-facing load balancer, router, or AF_XDP dataplane, so any remote host that can route packets to the interface reaches the vulnerable code.\nAC:L - Every packet the XDP program redirects deterministically executes the erroneous `dma_unmap_page_attrs()` on the page-pool-owned mapping \u2014 there is no race, no memory-layout requirement, and no probabilistic gate. The attacker further controls traffic volume and timing, which is exactly what drives IOVA turnover and makes the freed IOVA get reassigned to a live mapping.\nPR:N - The code runs in NAPI softirq context on packet reception before any authentication, authorization, or socket ownership check; the packet source is an arbitrary unauthenticated remote host. No kernel privilege, capability, or local account is involved in triggering it.\nUI:N - No victim action is needed \u2014 the bug fires automatically during normal packet processing as soon as a redirected frame arrives. No user must open, mount, connect to, or interact with anything.\nS:C - The defect corrupts the DMA/IOMMU mapping lifetime itself: the NIC is left holding an IOVA it no longer owns and the driver tears down mappings owned by other DMA users in the same IOMMU domain. The IOMMU is the authority that confines device DMA to authorized host memory, so the impacted resources lie outside the driver\u0027s own security scope \u2014 a DMA/IOMMU boundary bypass.\nC:H - In XDP mode `bp-\u003erx_dir` is `DMA_BIDIRECTIONAL`, so once the freed IOVA is reassigned the NIC can read host memory belonging to an unrelated DMA mapping and transmit it onto the network. The SWIOTLB variant double-frees a bounce slot, letting one mapping\u0027s contents be handed to another \u2014 arbitrary cross-buffer disclosure.\nI:H - The device writes attacker-controlled packet payload through a stale IOVA into memory that now belongs to a different DMA mapping, and the second `dma_unmap_page_attrs()` destroys another mapping\u0027s page-table entries. That is an attacker-influenced write primitive into memory outside the driver\u0027s authorized region.\nA:H - The immediate observed effect is a `WARN_ON` in `iommu_dma_unmap_page()` with kernel taint \u2014 fatal under `panic_on_warn` \u2014 and the underlying mapping corruption produces IOMMU/DMAR fault storms, NIC reset and link loss, and corruption of unrelated devices\u0027 in-flight DMA. It can be sustained indefinitely by a remote attacker simply sending traffic."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:37:26.610Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/fa4e6ae38574d0fc5596272bee64727d8ab7052b"
        },
        {
          "url": "https://git.kernel.org/stable/c/95a305ba259b685780ed62ea2295aa2feb2d6c0c"
        },
        {
          "url": "https://git.kernel.org/stable/c/8baeef7616d5194045c5a6b97fd1246b87c55b13"
        }
      ],
      "title": "bnxt_en: Fix double DMA unmapping for XDP_REDIRECT",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-44984",
    "datePublished": "2024-09-04T19:54:33.487Z",
    "dateReserved": "2024-08-21T05:34:56.670Z",
    "dateUpdated": "2026-08-05T11:37:26.610Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-44984",
      "date": "2026-08-13",
      "epss": "0.00737",
      "percentile": "0.51298"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.6\", \"versionEndExcluding\": \"6.6.48\", \"matchCriteriaId\": \"F83B546B-6FA2-483D-A14D-3C7EB9CAD99D\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.7\", \"versionEndExcluding\": \"6.10.7\", \"matchCriteriaId\": \"D2AFDFD1-D95A-4EB7-843B-5E7659518B67\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.11:rc1:*:*:*:*:*:*\", \"matchCriteriaId\": \"8B3CE743-2126-47A3-8B7C-822B502CF119\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.11:rc2:*:*:*:*:*:*\", \"matchCriteriaId\": \"4DEB27E7-30AA-45CC-8934-B89263EF3551\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.11:rc3:*:*:*:*:*:*\", \"matchCriteriaId\": \"E0005AEF-856E-47EB-BFE4-90C46899394D\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.11:rc4:*:*:*:*:*:*\", \"matchCriteriaId\": \"39889A68-6D34-47A6-82FC-CD0BF23D6754\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbnxt_en: Fix double DMA unmapping for XDP_REDIRECT\\n\\nRemove the dma_unmap_page_attrs() call in the driver\u0027s XDP_REDIRECT\\ncode path.  This should have been removed when we let the page pool\\nhandle the DMA mapping.  This bug causes the warning:\\n\\nWARNING: CPU: 7 PID: 59 at drivers/iommu/dma-iommu.c:1198 iommu_dma_unmap_page+0xd5/0x100\\nCPU: 7 PID: 59 Comm: ksoftirqd/7 Tainted: G        W          6.8.0-1010-gcp #11-Ubuntu\\nHardware name: Dell Inc. PowerEdge R7525/0PYVT1, BIOS 2.15.2 04/02/2024\\nRIP: 0010:iommu_dma_unmap_page+0xd5/0x100\\nCode: 89 ee 48 89 df e8 cb f2 69 ff 48 83 c4 08 5b 41 5c 41 5d 41 5e 41 5f 5d 31 c0 31 d2 31 c9 31 f6 31 ff 45 31 c0 e9 ab 17 71 00 \u003c0f\u003e 0b 48 83 c4 08 5b 41 5c 41 5d 41 5e 41 5f 5d 31 c0 31 d2 31 c9\\nRSP: 0018:ffffab1fc0597a48 EFLAGS: 00010246\\nRAX: 0000000000000000 RBX: ffff99ff838280c8 RCX: 0000000000000000\\nRDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000\\nRBP: ffffab1fc0597a78 R08: 0000000000000002 R09: ffffab1fc0597c1c\\nR10: ffffab1fc0597cd3 R11: ffff99ffe375acd8 R12: 00000000e65b9000\\nR13: 0000000000000050 R14: 0000000000001000 R15: 0000000000000002\\nFS:  0000000000000000(0000) GS:ffff9a06efb80000(0000) knlGS:0000000000000000\\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\\nCR2: 0000565c34c37210 CR3: 00000005c7e3e000 CR4: 0000000000350ef0\\n? show_regs+0x6d/0x80\\n? __warn+0x89/0x150\\n? iommu_dma_unmap_page+0xd5/0x100\\n? report_bug+0x16a/0x190\\n? handle_bug+0x51/0xa0\\n? exc_invalid_op+0x18/0x80\\n? iommu_dma_unmap_page+0xd5/0x100\\n? iommu_dma_unmap_page+0x35/0x100\\ndma_unmap_page_attrs+0x55/0x220\\n? bpf_prog_4d7e87c0d30db711_xdp_dispatcher+0x64/0x9f\\nbnxt_rx_xdp+0x237/0x520 [bnxt_en]\\nbnxt_rx_pkt+0x640/0xdd0 [bnxt_en]\\n__bnxt_poll_work+0x1a1/0x3d0 [bnxt_en]\\nbnxt_poll+0xaa/0x1e0 [bnxt_en]\\n__napi_poll+0x33/0x1e0\\nnet_rx_action+0x18a/0x2f0\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: bnxt_en: Se ha corregido la doble anulaci\\u00f3n de la asignaci\\u00f3n de DMA para XDP_REDIRECT. Se ha eliminado la llamada dma_unmap_page_attrs() en la ruta de c\\u00f3digo XDP_REDIRECT del controlador. Esto deber\\u00eda haberse eliminado cuando dejamos que el grupo de p\\u00e1ginas se encargara de la asignaci\\u00f3n de DMA. Este error provoca la advertencia: ADVERTENCIA: CPU: 7 PID: 59 en drivers/iommu/dma-iommu.c:1198 iommu_dma_unmap_page+0xd5/0x100 CPU: 7 PID: 59 Comm: ksoftirqd/7 Contaminado: GW 6.8.0-1010-gcp #11-Ubuntu Nombre del hardware: Dell Inc. PowerEdge R7525/0PYVT1, BIOS 2.15.2 04/02/2024 RIP: 0010:iommu_dma_unmap_page+0xd5/0x100 C\\u00f3digo: 89 ee 48 89 df e8 cb f2 69 ff 48 83 c4 08 5b 41 5c 41 5d 41 5e 41 5f 5d 31 c0 31 d2 31 c9 31 f6 31 ff 45 31 c0 e9 ab 17 71 00 \u0026lt;0f\u0026gt; 0b 48 83 c4 08 5b 41 5c 41 5d 41 5e 41 5f 5d 31 c0 31 d2 31 c9 RSP: 0018:ffffab1fc0597a48 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffff99ff838280c8 RCX: 000000000000000 RDX: 0000000000000000 RSI: 00000000000000000 RDI: 0000000000000000 RBP: ffffab1fc0597a78 R08: 0000000000000002 R09: ffffab1fc0597c1c R10: ffffab1fc0597cd3 R11: ffff99ffe375acd8 R12: 00000000e65b9000 R13: 0000000000000050 R14: 0000000000001000 R15: 0000000000000002 FS: 000000000000000(0000) GS:ffff9a06efb80000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000565c34c37210 CR3: 00000005c7e3e000 CR4: 0000000000350ef0 ? mostrar_regs+0x6d/0x80 ? __warn+0x89/0x150 ? iommu_dma_unmap_page+0xd5/0x100 ? informar_error+0x16a/0x190 ? manejar_error+0x51/0xa0 ? dma_unmap_page_attrs+0x55/0x220 ? bpf_prog_4d7e87c0d30db711_xdp_dispatcher+0x64/0x9f bnxt_rx_xdp+0x237/0x520 [bnxt_es] bnxt_rx_pkt+0x640/0xdd0 [bnxt_es] __bnxt_poll_work+0x1a1/0x3d0 [bnxt_es] bnxt_poll+0xaa/0x1e0 [bnxt_es] __napi_poll+0x33/0x1e0 net_rx_action+0x18a/0x2f0\"}]",
      "id": "CVE-2024-44984",
      "lastModified": "2024-10-10T16:48:56.167",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"baseScore\": 5.5, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 3.6}]}",
      "published": "2024-09-04T20:15:07.717",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/8baeef7616d5194045c5a6b97fd1246b87c55b13\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/95a305ba259b685780ed62ea2295aa2feb2d6c0c\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/fa4e6ae38574d0fc5596272bee64727d8ab7052b\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Analyzed",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"NVD-CWE-noinfo\"}]}]"
    },
    "microsoft_vex": {
      "current_release_date": "2026-02-18T14:02:05.000Z",
      "cve": "CVE-2024-44984",
      "id": "msrc_CVE-2024-44984",
      "initial_release_date": "2024-09-01T07:00:00.000Z",
      "product_status:fixed": "2",
      "product_status:known_affected": "2",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "bnxt_en: Fix double DMA unmapping for XDP_REDIRECT",
      "url": "https://msrc.microsoft.com/csaf/vex/2024/msrc_cve-2024-44984.json",
      "version": "2"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-44984\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-09-04T20:15:07.717\",\"lastModified\":\"2026-08-04T11:20:06.330\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbnxt_en: Fix double DMA unmapping for XDP_REDIRECT\\n\\nRemove the dma_unmap_page_attrs() call in the driver\u0027s XDP_REDIRECT\\ncode path.  This should have been removed when we let the page pool\\nhandle the DMA mapping.  This bug causes the warning:\\n\\nWARNING: CPU: 7 PID: 59 at drivers/iommu/dma-iommu.c:1198 iommu_dma_unmap_page+0xd5/0x100\\nCPU: 7 PID: 59 Comm: ksoftirqd/7 Tainted: G        W          6.8.0-1010-gcp #11-Ubuntu\\nHardware name: Dell Inc. PowerEdge R7525/0PYVT1, BIOS 2.15.2 04/02/2024\\nRIP: 0010:iommu_dma_unmap_page+0xd5/0x100\\nCode: 89 ee 48 89 df e8 cb f2 69 ff 48 83 c4 08 5b 41 5c 41 5d 41 5e 41 5f 5d 31 c0 31 d2 31 c9 31 f6 31 ff 45 31 c0 e9 ab 17 71 00 \u003c0f\u003e 0b 48 83 c4 08 5b 41 5c 41 5d 41 5e 41 5f 5d 31 c0 31 d2 31 c9\\nRSP: 0018:ffffab1fc0597a48 EFLAGS: 00010246\\nRAX: 0000000000000000 RBX: ffff99ff838280c8 RCX: 0000000000000000\\nRDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000\\nRBP: ffffab1fc0597a78 R08: 0000000000000002 R09: ffffab1fc0597c1c\\nR10: ffffab1fc0597cd3 R11: ffff99ffe375acd8 R12: 00000000e65b9000\\nR13: 0000000000000050 R14: 0000000000001000 R15: 0000000000000002\\nFS:  0000000000000000(0000) GS:ffff9a06efb80000(0000) knlGS:0000000000000000\\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\\nCR2: 0000565c34c37210 CR3: 00000005c7e3e000 CR4: 0000000000350ef0\\n? show_regs+0x6d/0x80\\n? __warn+0x89/0x150\\n? iommu_dma_unmap_page+0xd5/0x100\\n? report_bug+0x16a/0x190\\n? handle_bug+0x51/0xa0\\n? exc_invalid_op+0x18/0x80\\n? iommu_dma_unmap_page+0xd5/0x100\\n? iommu_dma_unmap_page+0x35/0x100\\ndma_unmap_page_attrs+0x55/0x220\\n? bpf_prog_4d7e87c0d30db711_xdp_dispatcher+0x64/0x9f\\nbnxt_rx_xdp+0x237/0x520 [bnxt_en]\\nbnxt_rx_pkt+0x640/0xdd0 [bnxt_en]\\n__bnxt_poll_work+0x1a1/0x3d0 [bnxt_en]\\nbnxt_poll+0xaa/0x1e0 [bnxt_en]\\n__napi_poll+0x33/0x1e0\\nnet_rx_action+0x18a/0x2f0\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: bnxt_en: Se ha corregido la doble anulaci\u00f3n de la asignaci\u00f3n de DMA para XDP_REDIRECT. Se ha eliminado la llamada dma_unmap_page_attrs() en la ruta de c\u00f3digo XDP_REDIRECT del controlador. Esto deber\u00eda haberse eliminado cuando dejamos que el grupo de p\u00e1ginas se encargara de la asignaci\u00f3n de DMA. Este error provoca la advertencia: ADVERTENCIA: CPU: 7 PID: 59 en drivers/iommu/dma-iommu.c:1198 iommu_dma_unmap_page+0xd5/0x100 CPU: 7 PID: 59 Comm: ksoftirqd/7 Contaminado: GW 6.8.0-1010-gcp #11-Ubuntu Nombre del hardware: Dell Inc. PowerEdge R7525/0PYVT1, BIOS 2.15.2 04/02/2024 RIP: 0010:iommu_dma_unmap_page+0xd5/0x100 C\u00f3digo: 89 ee 48 89 df e8 cb f2 69 ff 48 83 c4 08 5b 41 5c 41 5d 41 5e 41 5f 5d 31 c0 31 d2 31 c9 31 f6 31 ff 45 31 c0 e9 ab 17 71 00 \u0026lt;0f\u0026gt; 0b 48 83 c4 08 5b 41 5c 41 5d 41 5e 41 5f 5d 31 c0 31 d2 31 c9 RSP: 0018:ffffab1fc0597a48 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffff99ff838280c8 RCX: 000000000000000 RDX: 0000000000000000 RSI: 00000000000000000 RDI: 0000000000000000 RBP: ffffab1fc0597a78 R08: 0000000000000002 R09: ffffab1fc0597c1c R10: ffffab1fc0597cd3 R11: ffff99ffe375acd8 R12: 00000000e65b9000 R13: 0000000000000050 R14: 0000000000001000 R15: 0000000000000002 FS: 000000000000000(0000) GS:ffff9a06efb80000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000565c34c37210 CR3: 00000005c7e3e000 CR4: 0000000000350ef0 ? mostrar_regs+0x6d/0x80 ? __warn+0x89/0x150 ? iommu_dma_unmap_page+0xd5/0x100 ? informar_error+0x16a/0x190 ? manejar_error+0x51/0xa0 ? dma_unmap_page_attrs+0x55/0x220 ? bpf_prog_4d7e87c0d30db711_xdp_dispatcher+0x64/0x9f bnxt_rx_xdp+0x237/0x520 [bnxt_es] bnxt_rx_pkt+0x640/0xdd0 [bnxt_es] __bnxt_poll_work+0x1a1/0x3d0 [bnxt_es] bnxt_poll+0xaa/0x1e0 [bnxt_es] __napi_poll+0x33/0x1e0 net_rx_action+0x18a/0x2f0\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"578fcfd26e2a1d0e687b347057959228567e2af8\",\"lessThan\":\"fa4e6ae38574d0fc5596272bee64727d8ab7052b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"578fcfd26e2a1d0e687b347057959228567e2af8\",\"lessThan\":\"95a305ba259b685780ed62ea2295aa2feb2d6c0c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"578fcfd26e2a1d0e687b347057959228567e2af8\",\"lessThan\":\"8baeef7616d5194045c5a6b97fd1246b87c55b13\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.6\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.6\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.48\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.10.7\",\"lessThanOrEqual\":\"6.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.11\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H\",\"baseScore\":10.0,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":6.0},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.6\",\"versionEndExcluding\":\"6.6.48\",\"matchCriteriaId\":\"F83B546B-6FA2-483D-A14D-3C7EB9CAD99D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.10.7\",\"matchCriteriaId\":\"D2AFDFD1-D95A-4EB7-843B-5E7659518B67\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.11:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"8B3CE743-2126-47A3-8B7C-822B502CF119\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.11:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"4DEB27E7-30AA-45CC-8934-B89263EF3551\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.11:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"E0005AEF-856E-47EB-BFE4-90C46899394D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.11:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"39889A68-6D34-47A6-82FC-CD0BF23D6754\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/8baeef7616d5194045c5a6b97fd1246b87c55b13\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/95a305ba259b685780ed62ea2295aa2feb2d6c0c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/fa4e6ae38574d0fc5596272bee64727d8ab7052b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T18:13:23+00:00",
      "cve": "CVE-2024-44984",
      "id": "CVE-2024-44984",
      "initial_release_date": "2024-09-04T00:00:00+00:00",
      "product_status:fixed": "280",
      "product_status:known_affected": "64",
      "product_status:known_not_affected": "56",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: bnxt_en: Fix double DMA unmapping for XDP_REDIRECT",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-44984.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-07-25T01:40:21Z",
      "cve": "CVE-2024-44984",
      "id": "CVE-2024-44984",
      "initial_release_date": "2024-09-05T02:46:41Z",
      "product_status:known_affected": "394",
      "product_status:known_not_affected": "353",
      "product_status:recommended": "357",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-44984",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-44984.json",
      "version": "73"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.