CVE-2024-42281

What it actually does

The flaw fails to linearize the skb when downgrading gso_size, allowing a subsequent segmentation operation to hit a BUG_ON() in the kernel networking stack.

Why it matters to the business

Local denial-of-service on Linux systems can disrupt services, increase downtime, and affect the 3,277 downstream dependents that rely on the kernel; no ransomware usage or CISA deadline applies.

How an attack unfolds

A local attacker with low privileges crafts network traffic or BPF programs that trigger gso_size downgrade without skb linearization; when the packet is later segmented, the kernel hits the BUG_ON and crashes. Threat actors in 2024 Zero-Day Exploitation Campaigns and those targeting Linux Kernel Use of Uninitialized Resource or Out-of-Bounds Write issues have shown interest in similar kernel paths.

How to fix it

Apply the upstream fix that ensures skb linearization on gso_size downgrade; upgrade affected Linux kernel packages to the version containing the resolution. For bootstrap components listed in the advisory, update to bootstrap (npm) 4.3.1, bootstrap (RubyGems) 4.3.1, or org.webjars:bootstrap (Maven) 4.3.1 / 3.4.1 as applicable.

How to confirm the fix worked

Confirm the kernel patch is present by checking the commit that adds skb linearization before gso_size downgrade; test with reproducers that exercise gso_size changes and verify no BUG_ON occurs; scan for the listed bootstrap fixed versions in package manifests.

Typical attack path

1. Obtain local user access on an affected Linux system
2. Trigger BPF or networking code paths that downgrade gso_size
3. Force skb segmentation without prior linearization
4. Trigger BUG_ON() resulting in kernel panic and DoS

How to detect it

Review kernel logs for BUG_ON messages related to skb segmentation or gso_size; inspect audit logs for local processes invoking BPF or networking syscalls that alter GSO parameters; correlate with threat actor TTPs around Linux kernel resource issues.

What your security team should do

• Prioritize kernel updates on all Linux hosts given the local DoS impact and ecosystem prevalence
• Monitor EPSS trend (stable at ~0.0024) and absence from KEV for scheduling
• Restrict untrusted local code execution that can interact with BPF or GSO paths
• Validate bootstrap package versions across npm, RubyGems, and Maven deployments