CVE-2024-49948

What it actually does

Insufficient sanity checks in qdisc_pkt_len_init() allow a crafted GSO packet (short IPv4+TCP headers totaling 80 bytes with small gso_size) passed through virtio_net_hdr_to_skb() to trigger an underflow of qdisc_skb_cb(skb)->pkt_len when SKB_GSO_DODGY handling assumes skb->len exceeds hdr_len.

Why it matters to the business

Local users can trigger kernel panics or crashes in network packet queuing, causing denial of service on affected Linux systems and disrupting network-dependent services or workloads.

How an attack unfolds

An attacker with local access crafts a malicious GSO packet with 20-byte IPv4 and 60-byte TCP headers plus small gso_size, submits it via virtio_net_hdr_to_skb(), bypasses existing length checks, and causes qdisc_pkt_len_init() to underflow pkt_len, crashing the system.

How to fix it

Update the Linux kernel to commit d7d1a28f5dd57b4d83def876f8d7b4403bd37df9 or later; for trousers on Rocky Linux 8 upgrade to version 0:0.3.15-1.el8. Reboot after applying the kernel update.

How to confirm the fix worked

Verify the running kernel contains commit d7d1a28f5dd57b4d83def876f8d7b4403bd37df9; confirm qdisc_pkt_len_init() contains the additional length sanity checks; test with a reproducer packet that previously triggered the underflow.

Typical attack path

1. Obtain local user access on a vulnerable Linux kernel host
2. Construct a GSO packet with minimal valid headers but undersized gso_size
3. Inject the packet through a virtio network path that calls virtio_net_hdr_to_skb()
4. Trigger qdisc processing so qdisc_pkt_len_init() performs the underflow calculation
5. Cause kernel panic or denial of service

How to detect it

Review kernel logs for oops or panic messages referencing qdisc_pkt_len_init or pkt_len underflow; inspect virtio net header processing paths and GSO packet handling in system call traces.

What your security team should do

• Apply the kernel fix immediately on all exposed systems given the local attack vector
• Prioritize systems handling untrusted network traffic or virtualization
• Monitor for local privilege-escalation attempts that could chain into this issue
• Audit custom network drivers or GSO handling code for similar missing checks