Full vulnerability report · 2024

CVE-2024-50039High confidence

net/sched: accept TCA_STAB only for root qdisc

Linux · Linux

7.8HighCVSS 3.1

Recommended action

Patch only the product branches with a verified fix

High technical severity; prioritise exposed affected systems while verifying vendor guidance. Verified remediation exists for at least one product or source, but 23 structured product or package states remain unresolved. Apply remediation only to the exact product branch confirmed by its source.

Fix availability varies by product

Operational reassessment

Published severity in operational context

Open reassessment dashboard →

Published severityHighOperational priority:Medium, lowered one band.downgradedsince 5 Aug 2026

Evidence used

No CISA KEV confirmation is currently recorded.
Exploitation requires an existing local or physical foothold with privileges.
EPSS is 0.25% for the current model date.

Compensating controls

Validate the affected product branch and deploy the verified fixed release.
Restrict local access and enforce least privilege on affected hosts.
Monitor vendor guidance and exploitation sources for a material change.

Verification

Confirm that the asset runs Linux Linux and falls inside the recorded affected range.
Verify the installed build against the product-specific fixed version after deployment.
Validate exposure, authentication requirements and compensating controls in the actual environment.
Reopen this reassessment when CVSS, KEV, EPSS, exploit evidence or remediation changes.

Cross-source reconciliation

Remediation availability differs by product scope

Verified remediation exists for at least one product or source, but 23 structured product or package states remain unresolved. Apply remediation only to the exact product branch confirmed by its source.

Siemens ProductCERT: 1 affected or under-investigation product state without a fixed product state in the same current advisory
Siemens ProductCERT: 3 affected or under-investigation product states without a fixed product state in the same current advisory
Canonical Ubuntu Security: 19 affected package states with no published fix

Distribution package intelligence

Release-specific package status

Debian, ubuntu findings are scoped to the named distribution, release and source package. An absent finding does not mean a package is unaffected.

23 package states

Package result overrides the generic status

BlackTree has verified remediation for at least one product or source, but the relevant distribution still reports no fixed package for 19 affected package states shown here. Treat those rows as affected with no fix until that distribution publishes a fixed version.

Repository candidate not checked

A published vendor fix does not prove that a matching update is enabled and installable on a particular asset. Confirm the local package candidate before scheduling remediation.

Distribution release	Source package	Vendor state	Fixed version	Evidence
Debian trixietrixie · source	`linux`	Vendor fix publishedDebian records a fixed source-package version for this release.	`6.11.4-1`	Debian Security Tracker ↗Source updated 6 Oct 2026
Debian bookwormbookworm · source	`linux`	Vendor fix publishedDebian records a fixed source-package version for this release.	`6.1.115-1`	Debian Security Tracker ↗Source updated 6 Oct 2026
Debian forkyforky · source	`linux`	Vendor fix publishedDebian records a fixed source-package version for this release.	`6.11.4-1`	Debian Security Tracker ↗Source updated 6 Oct 2026
Debian sidsid · source	`linux`	Vendor fix publishedDebian records a fixed source-package version for this release.	`6.11.4-1`	Debian Security Tracker ↗Source updated 6 Oct 2026
Ubuntu 24.04 LTSnoble · standard archive	`linux`	Affected, no fix publishedCanonical OVAL identifies this running kernel flavour as affected and does not publish a fixed package version in this definition.	`Not published in this feed`	Canonical Ubuntu Security ↗Source updated 5 Oct 2026
Ubuntu 24.04 LTSnoble · standard archive	`linux-aws`	Affected, no fix publishedCanonical OVAL identifies this running kernel flavour as affected and does not publish a fixed package version in this definition.	`Not published in this feed`	Canonical Ubuntu Security ↗Source updated 5 Oct 2026
Ubuntu 24.04 LTSnoble · standard archive	`linux-azure`	Affected, no fix publishedCanonical OVAL identifies this running kernel flavour as affected and does not publish a fixed package version in this definition.	`Not published in this feed`	Canonical Ubuntu Security ↗Source updated 5 Oct 2026
Ubuntu 24.04 LTSnoble · standard archive	`linux-azure-nvidia`	Affected, no fix publishedCanonical OVAL identifies this running kernel flavour as affected and does not publish a fixed package version in this definition.	`Not published in this feed`	Canonical Ubuntu Security ↗Source updated 5 Oct 2026
Ubuntu 24.04 LTSnoble · standard archive	`linux-gcp`	Affected, no fix publishedCanonical OVAL identifies this running kernel flavour as affected and does not publish a fixed package version in this definition.	`Not published in this feed`	Canonical Ubuntu Security ↗Source updated 5 Oct 2026
Ubuntu 24.04 LTSnoble · standard archive	`linux-gke`	Affected, no fix publishedCanonical OVAL identifies this running kernel flavour as affected and does not publish a fixed package version in this definition.	`Not published in this feed`	Canonical Ubuntu Security ↗Source updated 5 Oct 2026
Ubuntu 24.04 LTSnoble · standard archive	`linux-gkeop`	Affected, no fix publishedCanonical OVAL identifies this running kernel flavour as affected and does not publish a fixed package version in this definition.	`Not published in this feed`	Canonical Ubuntu Security ↗Source updated 5 Oct 2026
Ubuntu 24.04 LTSnoble · standard archive	`linux-ibm`	Affected, no fix publishedCanonical OVAL identifies this running kernel flavour as affected and does not publish a fixed package version in this definition.	`Not published in this feed`	Canonical Ubuntu Security ↗Source updated 5 Oct 2026
Ubuntu 24.04 LTSnoble · standard archive	`linux-lowlatency`	Affected, no fix publishedCanonical OVAL identifies this running kernel flavour as affected and does not publish a fixed package version in this definition.	`Not published in this feed`	Canonical Ubuntu Security ↗Source updated 5 Oct 2026
Ubuntu 24.04 LTSnoble · standard archive	`linux-nvidia`	Affected, no fix publishedCanonical OVAL identifies this running kernel flavour as affected and does not publish a fixed package version in this definition.	`Not published in this feed`	Canonical Ubuntu Security ↗Source updated 5 Oct 2026
Ubuntu 24.04 LTSnoble · standard archive	`linux-nvidia-lowlatency`	Affected, no fix publishedCanonical OVAL identifies this running kernel flavour as affected and does not publish a fixed package version in this definition.	`Not published in this feed`	Canonical Ubuntu Security ↗Source updated 5 Oct 2026
Ubuntu 24.04 LTSnoble · standard archive	`linux-nvidia-tegra`	Affected, no fix publishedCanonical OVAL identifies this running kernel flavour as affected and does not publish a fixed package version in this definition.	`Not published in this feed`	Canonical Ubuntu Security ↗Source updated 5 Oct 2026
Ubuntu 24.04 LTSnoble · standard archive	`linux-oem-6.11`	Affected, no fix publishedCanonical OVAL identifies this running kernel flavour as affected and does not publish a fixed package version in this definition.	`Not published in this feed`	Canonical Ubuntu Security ↗Source updated 5 Oct 2026
Ubuntu 24.04 LTSnoble · standard archive	`linux-oracle`	Affected, no fix publishedCanonical OVAL identifies this running kernel flavour as affected and does not publish a fixed package version in this definition.	`Not published in this feed`	Canonical Ubuntu Security ↗Source updated 5 Oct 2026
Ubuntu 24.04 LTSnoble · standard archive	`linux-raspi`	Affected, no fix publishedCanonical OVAL identifies this running kernel flavour as affected and does not publish a fixed package version in this definition.	`Not published in this feed`	Canonical Ubuntu Security ↗Source updated 5 Oct 2026
Ubuntu 24.04 LTSnoble · standard archive	`linux-raspi-realtime`	Affected, no fix publishedCanonical OVAL identifies this running kernel flavour as affected and does not publish a fixed package version in this definition.	`Not published in this feed`	Canonical Ubuntu Security ↗Source updated 5 Oct 2026
Ubuntu 24.04 LTSnoble · standard archive	`linux-realtime`	Affected, no fix publishedCanonical OVAL identifies this running kernel flavour as affected and does not publish a fixed package version in this definition.	`Not published in this feed`	Canonical Ubuntu Security ↗Source updated 5 Oct 2026
Ubuntu 24.04 LTSnoble · standard archive	`linux-riscv`	Affected, no fix publishedCanonical OVAL identifies this running kernel flavour as affected and does not publish a fixed package version in this definition.	`Not published in this feed`	Canonical Ubuntu Security ↗Source updated 5 Oct 2026
Ubuntu 24.04 LTSnoble · standard archive	`linux-xilinx`	Affected, no fix publishedCanonical OVAL identifies this running kernel flavour as affected and does not publish a fixed package version in this definition.	`Not published in this feed`	Canonical Ubuntu Security ↗Source updated 5 Oct 2026

Direct vendor intelligence

Authoritative vendor CSAF and VEX advisories

Structured product status and remediation from the issuing vendor. Product-state explanations are always visible; large lists can be searched or downloaded.

3 current

CVE-2024-50039 · CSAF 2.0 · revision 3 · finalRed Hat Product Securitykernel: net/sched: accept TCA_STAB only for root qdisc

112 known affected

The vendor explicitly identifies these products as affected by this CVE.

kernel as a component of Red Hat Enterprise Linux 6
kernel-abi-whitelists as a component of Red Hat Enterprise Linux 6
kernel-bootwrapper as a component of Red Hat Enterprise Linux 6
kernel-debug as a component of Red Hat Enterprise Linux 6
kernel-debug-devel as a component of Red Hat Enterprise Linux 6
kernel-devel as a component of Red Hat Enterprise Linux 6
kernel-doc as a component of Red Hat Enterprise Linux 6
kernel-firmware as a component of Red Hat Enterprise Linux 6
kernel-headers as a component of Red Hat Enterprise Linux 6
kernel-kdump as a component of Red Hat Enterprise Linux 6
kernel-kdump-devel as a component of Red Hat Enterprise Linux 6
kernel.src as a component of Red Hat Enterprise Linux 6

Summary: A flaw was found in the Linux kernel's network scheduler. A local attacker with low privileges could exploit a vulnerability related to the handling of the `TCA_STAB` traffic control attribute when used with certain queueing disciplines (qdiscs) like TBF and SFQ. This improper handling can lead to a kernel NULL pointer dereference, causing the system to crash and resulting in a denial of service.
Remediation: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect.

SSA-265688 · CSAF 2.0 · revision 13 · interimSiemens ProductCERTSSA-265688: Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 TM MFP V1.1

1 known affected

The vendor explicitly identifies these products as affected by this CVE.

SIMATIC S7-1500 TM MFP - GNU/Linux subsystem

Summary: In the Linux kernel, the following vulnerability has been resolved: net/sched: accept TCA_STAB only for root qdisc Most qdiscs maintain their backlog using qdisc_pkt_len(skb) on the assumption it is invariant between the enqueue() and dequeue() handlers. Unfortunately syzbot can crash a host rather easily using a TBF + SFQ combination, with an STAB on SFQ [1] We can't support TCA_STAB on arbitrary level, this would require to maintain per-qdisc storage.
Remediation: Limit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.

SSA-355557 · CSAF 2.0 · revision 3 · interimSiemens ProductCERTSSA-355557: Multiple Vulnerabilities in Third-Party Components in SINEC OS before V3.2

3 known affected

The vendor explicitly identifies these products as affected by this CVE.

RUGGEDCOM RST2428P (6GK6242-6PA00)
SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family
SCALANCE XCM-/XRM-/XCH-/XRH-300 family

Summary: In the Linux kernel, the following vulnerability has been resolved: net/sched: accept TCA_STAB only for root qdisc Most qdiscs maintain their backlog using qdisc_pkt_len(skb) on the assumption it is invariant between the enqueue() and dequeue() handlers. Unfortunately syzbot can crash a host rather easily using a TBF + SFQ combination, with an STAB on SFQ [1] We can't support TCA_STAB on arbitrary level, this would require to maintain per-qdisc storage.
Remediation: Update to V3.2 or later version

Recommended actionPatch only the product branches with a verified fix

Fix availability varies by product

What, why and how

In the Linux kernel, the following vulnerability has been resolved: net/sched: accept TCA_STAB only for root qdisc Most qdiscs maintain their backlog using qdisc_pkt_len(skb) on the assumption it is invariant between the enqueue() and dequeue() handlers. Unfortunately syzbot can crash a host rather easily using a TBF + SFQ combination, with an STAB on SFQ [1] We can't support TCA_STAB on arbitrary level, this would require to maintain per-qdisc storage. [1] [ 88.796496] BUG: kernel NULL pointer dereference, address: 0000000000000000 [ 88.798611] #PF: supervisor read access in kernel mode [ 88.799014] #PF: error_code(0x0000) - not-present page [ 88.799506] PGD 0 P4D 0 [ 88.799829] Oops: Oops: 0000 [#1] SMP NOPTI [ 88.800569] CPU: 14 UID: 0 PID: 2053 Comm: b371744477 Not tainted 6.12.0-rc1-virtme #1117 [ 88.801107] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 88.801779] RIP: 0010:sfq_dequeue (net/sched/sch_sfq.c:272 net/sched/sch_sfq.c:499) sch_sfq [ 88.802544] Code: 0f b7 50 12 48 8d 04 d5 00 00 00 00 48 89 d6 48 29 d0 48 8b 91 c0 01 00 00 48 c1 e0 03 48 01 c2 66 83 7a 1a 00 7e c0 48 8b 3a <4c> 8b 07 4c 89 02 49 89 50 08 48 c7 47 08 00 00 00 00 48 c7 07 00 All code ======== 0: 0f b7 50 12 movzwl 0x12(%rax),%edx 4: 48 8d 04 d5 00 00 00 lea 0x0(,%rdx,8),%rax b: 00 c: 48 89 d6 mov %rdx,%rsi f: 48 29 d0 sub %rdx,%rax 12: 48 8b 91 c0 01 00 00 mov 0x1c0(%rcx),%rdx 19: 48 c1 e0 03 shl $0x3,%rax 1d: 48 01 c2 add %rax,%rdx 20: 66 83 7a 1a 00 cmpw $0x0,0x1a(%rdx) 25: 7e c0 jle 0xffffffffffffffe7 27: 48 8b 3a mov (%rdx),%rdi 2a:* 4c 8b 07 mov (%rdi),%r8 <-- trapping instruction 2d: 4c 89 02 mov %r8,(%rdx) 30: 49 89 50 08 mov %rdx,0x8(%r8) 34: 48 c7 47 08 00 00 00 movq $0x0,0x8(%rdi) 3b: 00 3c: 48 rex.W 3d: c7 .byte 0xc7 3e: 07 (bad) ... Code starting with the faulting instruction =========================================== 0: 4c 8b 07 mov (%rdi),%r8 3: 4c 89 02 mov %r8,(%rdx) 6: 49 89 50 08 mov %rdx,0x8(%r8) a: 48 c7 47 08 00 00 00 movq $0x0,0x8(%rdi) 11: 00 12: 48 rex.W 13: c7 .byte 0xc7 14: 07 (bad) ... [ 88.803721] RSP: 0018:ffff9a1f892b7d58 EFLAGS: 00000206 [ 88.804032] RAX: 0000000000000000 RBX: ffff9a1f8420c800 RCX: ffff9a1f8420c800 [ 88.804560] RDX: ffff9a1f81bc1440 RSI: 0000000000000000 RDI: 0000000000000000 [ 88.805056] RBP: ffffffffc04bb0e0 R08: 0000000000000001 R09: 00000000ff7f9a1f [ 88.805473] R10: 000000000001001b R11: 0000000000009a1f R12: 0000000000000140 [ 88.806194] R13: 0000000000000001 R14: ffff9a1f886df400 R15: ffff9a1f886df4ac [ 88.806734] FS: 00007f445601a740(0000) GS:ffff9a2e7fd80000(0000) knlGS:0000000000000000 [ 88.807225] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 88.807672] CR2: 0000000000000000 CR3: 000000050cc46000 CR4: 00000000000006f0 [ 88.808165] Call Trace: [ 88.808459] <TASK> [ 88.808710] ? __die (arch/x86/kernel/dumpstack.c:421 arch/x86/kernel/dumpstack.c:434) [ 88.809261] ? page_fault_oops (arch/x86/mm/fault.c:715) [ 88.809561] ? exc_page_fault (./arch/x86/include/asm/irqflags.h:26 ./arch/x86/include/asm/irqflags.h:87 ./arch/x86/include/asm/irqflags.h:147 arch/x86/mm/fault.c:1489 arch/x86/mm/fault.c:1539) [ 88.809806] ? asm_exc_page_fault (./arch/x86/include/asm/idtentry.h:623) [ 88.810074] ? sfq_dequeue (net/sched/sch_sfq.c:272 net/sched/sch_sfq.c:499) sch_sfq [ 88.810411] sfq_reset (net/sched/sch_sfq.c:525) sch_sfq [ 88.810671] qdisc_reset (./include/linux/skbuff.h:2135 ./include/linux/skbuff.h:2441 ./include/linux/skbuff.h:3304 ./include/linux/skbuff.h:3310 net/sched/sch_g ---truncated---

What

Why

The product dereferences a pointer that it expects to be valid but is NULL.

How

An attacker operating through local access may attempt exploitation with low privileges. If successful, the issue may disrupt the affected service.

What

Why

The product dereferences a pointer that it expects to be valid but is NULL.

How

An attacker operating through local access may attempt exploitation with low privileges. If successful, the issue may disrupt the affected service.

Exploit reality and attack path

CVSS severity, EPSS forecast probability, public exploit material and CISA-confirmed exploitation are separate signals.

Observed exploitation

Confirmed exploitation and public exploit material are separate signals. Attacks can occur without public proof-of-concept or exploit code.

No confirmed evidence

No CISA KEV match was present at the last successful refresh. This means no confirmation from that source, not proof of no exploitation.

Public PoC / exploit material

Confirmed exploitation and public exploit material are separate signals. Attacks can occur without public proof-of-concept or exploit code.

None recorded

No exploit-tagged reference or CISA SSVC proof-of-concept state is currently recorded. Research may still exist outside the structured feeds.

Likely attack path: local access → NULL Pointer Dereference → disrupt the affected service
Attack surface: Local
Privileges required: Low: a basic authenticated account is required
User interaction: None
Attack complexity: Low: no specialised conditions are recorded
Security boundary: Unchanged: impact remains within the vulnerable component's security authority
Weakness ? CWE means Common Weakness Enumeration: a standard category for the underlying weakness.: CWE-476 ↗
CWE-476: NULL Pointer Dereference. The product dereferences a pointer that it expects to be valid but is NULL.
CVSS vector ? CVSS means Common Vulnerability Scoring System. The vector records the metric values used to calculate technical severity.: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Common Vulnerability Scoring System 3.1: the compact vector below is decoded into plain language.
AVLocalAttack vector: The attacker needs local access to the vulnerable system.ACLowAttack complexity: No specialised conditions are required beyond attacker-controlled input.PRLowPrivileges required: The attacker needs basic user-level privileges.UINoneUser interaction: No action by another user is required.SUnchangedScope: The security impact remains within the vulnerable component's authority.CHighConfidentiality impact: A successful attack can cause a major loss.IHighIntegrity impact: A successful attack can cause a major loss.AHighAvailability impact: A successful attack can cause a major loss.
Post-exploitation / living off the land: The issue can support a local privilege or sandbox boundary transition; normal system utilities may then be available in the gained context.

Denial of serviceCWE-476

Official authority intelligence

Only matched European and national findings are included. Language selectors and unavailable sources are omitted.

ENISA EUVD · EUVD-2024-44984Official EUVD mapping

0 linked advisory records.

Official EUVD record ↗

BSI · German · WID-SEC-2025-2855IBM DataPower Gateway: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in IBM DataPower Gateway ausnutzen, um beliebigen Programmcode auszuführen, Daten zu manipulieren, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder andere, nicht spezifizierte Angriffe durchzuführen.

net/sched: accept TCA_STAB only for root qdisc

Evidence used

Compensating controls

Verification

Remediation availability differs by product scope

EUVD-2024-44984

What, why and how

Exploit reality and attack path

Official authority intelligence

Patch and workaround

Evidence and provenance