{
  "cveId": "CVE-2024-49980",
  "url": "https://patchblox.com/security/cve/CVE-2024-49980",
  "summary": "CVE-2024-49980 is fixed in linux on 1 platform, first by DEBIAN-CVE-2024-49980, released October 21, 2024. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "linux: In the Linux kernel, the following vulnerability has been resolved:  vrf: revert \u0022vrf: Remove unnecessary RCU-bh crit...",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  vrf: revert \u0022vrf: Remove unnecessary RCU-bh critical section\u0022  This reverts commit 504fc6f4f7f681d2a03aa5f68aad549d90eab853.  dev_queue_xmit_nit is expected to be called with BH disabled. __dev_queue_xmit has the following:          /* Disable soft irqs for various locks below. Also          * stops preemption for RCU.          */         rcu_read_lock_bh();  VRF must follow this invariant. The referenced commit removed this protection. Which triggered a lockdep warning:  \t================================ \tWARNING: inconsistent lock state \t6.11.0 #1 Tainted: G        W \t-------------------------------- \tinconsistent {IN-SOFTIRQ-W} -\u003E {SOFTIRQ-ON-W} usage. \tbtserver/134819 [HC0[0]:SC0[0]:HE1:SE1] takes: \tffff8882da30c118 (rlock-AF_PACKET){\u002B.?.}-{2:2}, at: tpacket_rcv\u002B0x863/0x3b30 \t{IN-SOFTIRQ-W} state was registered at: \t  lock_acquire\u002B0x19a/0x4f0 \t  _raw_spin_lock\u002B0x27/0x40 \t  packet_rcv\u002B0xa33/0x1320 \t  __netif_receive_skb_core.constprop.0\u002B0xcb0/0x3a90 \t  __netif_receive_skb_list_core\u002B0x2c9/0x890 \t  netif_receive_skb_list_internal\u002B0x610/0xcc0           [...]  \tother info that might help us debug this: \t Possible unsafe locking scenario:  \t       CPU0 \t       ---- \t  lock(rlock-AF_PACKET); \t  \u003CInterrupt\u003E \t    lock(rlock-AF_PACKET);  \t *** DEADLOCK ***  \tCall Trace: \t \u003CTASK\u003E \t dump_stack_lvl\u002B0x73/0xa0 \t mark_lock\u002B0x102e/0x16b0 \t __lock_acquire\u002B0x9ae/0x6170 \t lock_acquire\u002B0x19a/0x4f0 \t _raw_spin_lock\u002B0x27/0x40 \t tpacket_rcv\u002B0x863/0x3b30 \t dev_queue_xmit_nit\u002B0x709/0xa40 \t vrf_finish_direct\u002B0x26e/0x340 [vrf] \t vrf_l3_out\u002B0x5f4/0xe80 [vrf] \t __ip_local_out\u002B0x51e/0x7a0           [...]",
  "published": "2024-10-21T18:15:18Z",
  "severity": "medium",
  "cvss": 5.5,
  "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
  "epss": 0.00178,
  "epssPercentile": 0.07421,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "6.11.4-1",
      "fix": "DEBIAN-CVE-2024-49980",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2024-49980",
      "released": "2024-10-21T18:15:18Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "6.11.4-1",
      "fix": "DEBIAN-CVE-2024-49980",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2024-49980",
      "released": "2024-10-21T18:15:18Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T13:06:02Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}