{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 5.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-50206",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-01T20:17:35.887846Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-787",
                "description": "CWE-787 Out-of-bounds Write",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-01T20:27:06.677Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/mediatek/mtk_eth_soc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "68cd084e3ec1512cd383cb3e9cf0ab7ab413724c",
              "status": "affected",
              "version": "c57e558194430d10d5e5f4acd8a8655b68dade13",
              "versionType": "git"
            },
            {
              "lessThan": "88806efc034a9830f483963326b99930ad519af1",
              "status": "affected",
              "version": "c57e558194430d10d5e5f4acd8a8655b68dade13",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "6f50d0bc1bbd45ce2a6d8f378daa00e56c198e9e",
              "versionType": "git"
            },
            {
              "lessThan": "6.10",
              "status": "affected",
              "version": "6.9.6",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/mediatek/mtk_eth_soc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.10"
            },
            {
              "lessThan": "6.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.11.*",
              "status": "unaffected",
              "version": "6.11.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.12",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11.6",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.9.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ethernet: mtk_eth_soc: fix memory corruption during fq dma init\n\nThe loop responsible for allocating up to MTK_FQ_DMA_LENGTH buffers must\nonly touch as many descriptors, otherwise it ends up corrupting unrelated\nmemory. Fix the loop iteration count accordingly."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The mis-programmed QDMA free-queue descriptors cause the Ethernet MAC to DMA received/forwarded packet payload into kernel memory outside the mapped scratch buffers, so an unauthenticated remote peer sending traffic to the MT7988 router SoC\u0027s interface supplies the bytes written into unrelated kernel memory; traffic-induced FE errors (RFIFO_OV/FQ_EMPTY) also re-trigger the buggy init via the tx-timeout reset worker.\nAC:L - The off-by-bound is deterministic \u2014 on MT7988 (fq_dma_size 4K \u003e MTK_FQ_DMA_LENGTH 2K) it corrupts memory on every mtk_open()/reset with no race, no timing window, and no memory-layout precondition outside the attacker\u0027s influence.\nPR:N - The corrupt descriptor state is established automatically at boot/interface-up, and realizing the impact only requires sending packets to the device \u2014 no local account, credentials, or capabilities are needed.\nUI:N - No victim action is required; the driver programs the bad descriptors during normal interface initialization and the hardware DMA proceeds on ordinary network traffic.\nS:U - The out-of-bounds descriptor writes and the errant DMA both land in kernel memory managed by the same kernel security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The hardware is handed free-queue buffers spanning up to 4 MiB of memory beyond the mapping, so contents of unrelated kernel allocations can be pulled into packet buffers and emitted on the wire, giving disclosure of arbitrary kernel memory.\nI:H - 64 KiB of out-of-bounds descriptor writes past the scratch ring, combined with hardware DMA of attacker-controlled packet bytes into memory outside the dma_map_single() region, constitutes a write primitive into unrelated kernel structures usable for control-flow hijacking.\nA:H - Silent corruption of unrelated kernel memory, and DMA to addresses outside any valid mapping, readily produce oopses, panics, or hardware hangs on the affected SoC."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:42:29.327Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/68cd084e3ec1512cd383cb3e9cf0ab7ab413724c"
        },
        {
          "url": "https://git.kernel.org/stable/c/88806efc034a9830f483963326b99930ad519af1"
        }
      ],
      "title": "net: ethernet: mtk_eth_soc: fix memory corruption during fq dma init",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-50206",
    "datePublished": "2024-11-08T06:07:56.867Z",
    "dateReserved": "2024-10-21T19:36:19.969Z",
    "dateUpdated": "2026-08-05T11:42:29.327Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}