CVE-2024-49973

What it actually does

Insufficient buffer allocation for the RTL8125 tally counter allows the network chip to DMA new fields into unallocated kernel memory, resulting in memory corruption.

Why it matters to the business

Linux systems using affected Realtek network adapters may experience kernel crashes or instability, disrupting network-dependent services and requiring prioritized updates to restore reliability.

How an attack unfolds

A local attacker triggers the r8169 driver to read the tally counter on RTL8125 hardware; the chip then writes beyond the undersized DMA buffer, corrupting adjacent kernel memory and potentially enabling denial of service or further local privilege escalation in campaigns by espionage and financially motivated actors.

How to fix it

Update the Linux kernel to a version containing commit 64648ae8c97ec5a3165021627f5a1658ebe081ca or later; for Rocky Linux 8 gupnp packages, upgrade to 1.0.6-2.el8_4 or newer.

How to confirm the fix worked

Verify the running kernel includes the tally counter size fix by checking the driver source or kernel version against the fixed commit; confirm buffer allocation covers all RTL8125 tally fields.

Typical attack path

1. Obtain local user access on a Linux system with an RTL8125-based adapter
2. Perform network operations that cause the driver to access the tally counter
3. Trigger DMA writes that exceed the allocated buffer
4. Exploit resulting memory corruption for crash or escalation

How to detect it

Review kernel logs for r8169-related oops, DMA faults, or memory corruption messages; correlate with network interface activity on systems using Realtek RTL8125 hardware.

What your security team should do

• Apply the kernel update containing the tally counter allocation fix immediately on all affected systems
• Prioritize systems with RTL8125 adapters for patching due to potential local impact
• Monitor for post-patch stability and remove any temporary workarounds