In the Linux kernel, the following vulnerability has been resolved: net/smc: check v2_ext_offset/eid_cnt/ism_gid_cnt when receiving proposal msg… (CVE-2024-49568)
A vulnerability in the Linux kernel's net/smc component related to improper validation of certain fields in a proposal message from a remote client has been resolved. Specifically, the fields v2_ext_offset, eid_cnt, and ism_gid_cnt were not properly checked, which could lead to accessing incorrect memory addresses and cause a crash. The issue is addressed by adding validation checks on these fields before use.
AI Analysis
Technical Summary
CVE-2024-49568 concerns a flaw in the Linux kernel's net/smc module where the server processes proposal messages containing fields v2_ext_offset, eid_cnt, and ism_gid_cnt originating from remote clients. These fields were not fully validated, particularly v2_ext_offset, which if exceeding maximum allowed values, could cause the kernel to access invalid memory addresses, resulting in a crash. The vulnerability is mitigated by a patch that performs proper validation of these fields before they are used.
Potential Impact
The vulnerability can cause a denial of service via a kernel crash when processing specially crafted proposal messages due to invalid memory access. There is no indication of confidentiality or integrity impact. The CVSS score is 5.5 (medium severity), reflecting the local attack vector with low complexity and no user interaction required, but limited to availability impact.
Mitigation Recommendations
A patch has been applied to the Linux kernel that adds validation checks for the v2_ext_offset, eid_cnt, and ism_gid_cnt fields in proposal messages. Users should update to the fixed kernel version once available. Since this is a kernel-level issue, applying the official kernel update is the recommended remediation.
In the Linux kernel, the following vulnerability has been resolved: net/smc: check v2_ext_offset/eid_cnt/ism_gid_cnt when receiving proposal msg… (CVE-2024-49568)
Description
A vulnerability in the Linux kernel's net/smc component related to improper validation of certain fields in a proposal message from a remote client has been resolved. Specifically, the fields v2_ext_offset, eid_cnt, and ism_gid_cnt were not properly checked, which could lead to accessing incorrect memory addresses and cause a crash. The issue is addressed by adding validation checks on these fields before use.
CVSS v3.1
Score 5.5medium
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2024-49568 concerns a flaw in the Linux kernel's net/smc module where the server processes proposal messages containing fields v2_ext_offset, eid_cnt, and ism_gid_cnt originating from remote clients. These fields were not fully validated, particularly v2_ext_offset, which if exceeding maximum allowed values, could cause the kernel to access invalid memory addresses, resulting in a crash. The vulnerability is mitigated by a patch that performs proper validation of these fields before they are used.
Potential Impact
The vulnerability can cause a denial of service via a kernel crash when processing specially crafted proposal messages due to invalid memory access. There is no indication of confidentiality or integrity impact. The CVSS score is 5.5 (medium severity), reflecting the local attack vector with low complexity and no user interaction required, but limited to availability impact.
Mitigation Recommendations
A patch has been applied to the Linux kernel that adds validation checks for the v2_ext_offset, eid_cnt, and ism_gid_cnt fields in proposal messages. Users should update to the fixed kernel version once available. Since this is a kernel-level issue, applying the official kernel update is the recommended remediation.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-rgx8-6674-j479
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2024-49568"]
- Database Specific Severity
- MODERATE
- Cvss Version
- 3.1
Threat ID: 6ac13969a43b0b3b89d5fbb0
Added to database: 10/03/2026, 17:20:41 UTC
Last enriched: 10/03/2026, 17:23:52 UTC
Last updated: 10/04/2026, 02:45:59 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.