Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2024-56656— bnxt_en: Fix aggregation ID mask to prevent oops on 5760X chips

Quick assessment

Affected

Linux Linux

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于scsi:ufs模块中ufshcd_remove未取消RTC工作，导致空指针取消引用。

CVSS 9.8 · Critical EPSS 0.37% · P30 Updated Aug 05, 2026

Possible ATT&CK Techniques 1 AI

T1059 · Command and Scripting Interpreter

Affected Version Matrix 6

Vendor	Product	Version Range	Status
Linux	Linux	`13d2d3d381ee9844f89bd436ab0f44204660027e< fe9274027697c69c1430dc7ee568f82b331ef972`	affected
		`13d2d3d381ee9844f89bd436ab0f44204660027e< 24c6843b7393ebc80962b59d7ae71af91bf0dcc1`	affected
		`6.8`	affected
		`< 6.8`	unaffected
		`6.12.6≤ 6.12.*`	unaffected
		`6.13≤ *`	unaffected

Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2024-56656

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

bnxt_en: Fix aggregation ID mask to prevent oops on 5760X chips

Source: CVE Program / CVE List V5

Vulnerability Description

In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Fix aggregation ID mask to prevent oops on 5760X chips The 5760X (P7) chip's HW GRO/LRO interface is very similar to that of the previous generation (5750X or P5). However, the aggregation ID fields in the completion structures on P7 have been redefined from 16 bits to 12 bits. The freed up 4 bits are redefined for part of the metadata such as the VLAN ID. The aggregation ID mask was not modified when adding support for P7 chips. Including the extra 4 bits for the aggregation ID can potentially cause the driver to store or fetch the packet header of GRO/LRO packets in the wrong TPA buffer. It may hit the BUG() condition in __skb_pull() because the SKB contains no valid packet header: kernel BUG at include/linux/skbuff.h:2766! Oops: invalid opcode: 0000 1 PREEMPT SMP NOPTI CPU: 4 UID: 0 PID: 0 Comm: swapper/4 Kdump: loaded Tainted: G OE 6.12.0-rc2+ #7 Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE Hardware name: Dell Inc. PowerEdge R760/0VRV9X, BIOS 1.0.1 12/27/2022 RIP: 0010:eth_type_trans+0xda/0x140 Code: 80 00 00 00 eb c1 8b 47 70 2b 47 74 48 8b 97 d0 00 00 00 83 f8 01 7e 1b 48 85 d2 74 06 66 83 3a ff 74 09 b8 00 04 00 00 eb a5 <0f> 0b b8 00 01 00 00 eb 9c 48 85 ff 74 eb 31 f6 b9 02 00 00 00 48 RSP: 0018:ff615003803fcc28 EFLAGS: 00010283 RAX: 00000000000022d2 RBX: 0000000000000003 RCX: ff2e8c25da334040 RDX: 0000000000000040 RSI: ff2e8c25c1ce8000 RDI: ff2e8c25869f9000 RBP: ff2e8c258c31c000 R08: ff2e8c25da334000 R09: 0000000000000001 R10: ff2e8c25da3342c0 R11: ff2e8c25c1ce89c0 R12: ff2e8c258e0990b0 R13: ff2e8c25bb120000 R14: ff2e8c25c1ce89c0 R15: ff2e8c25869f9000 FS: 0000000000000000(0000) GS:ff2e8c34be300000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055f05317e4c8 CR3: 000000108bac6006 CR4: 0000000000773ef0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe07f0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: <IRQ> ? die+0x33/0x90 ? do_trap+0xd9/0x100 ? eth_type_trans+0xda/0x140 ? do_error_trap+0x65/0x80 ? eth_type_trans+0xda/0x140 ? exc_invalid_op+0x4e/0x70 ? eth_type_trans+0xda/0x140 ? asm_exc_invalid_op+0x16/0x20 ? eth_type_trans+0xda/0x140 bnxt_tpa_end+0x10b/0x6b0 [bnxt_en] ? bnxt_tpa_start+0x195/0x320 [bnxt_en] bnxt_rx_pkt+0x902/0xd90 [bnxt_en] ? __bnxt_tx_int.constprop.0+0x89/0x300 [bnxt_en] ? kmem_cache_free+0x343/0x440 ? __bnxt_tx_int.constprop.0+0x24f/0x300 [bnxt_en] __bnxt_poll_work+0x193/0x370 [bnxt_en] bnxt_poll_p5+0x9a/0x300 [bnxt_en] ? try_to_wake_up+0x209/0x670 __napi_poll+0x29/0x1b0 Fix it by redefining the aggregation ID mask for P5_PLUS chips to be 12 bits. This will work because the maximum aggregation ID is less than 4096 on all P5_PLUS chips.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

N/A

Source: CVE Program / CVE List V5

Vulnerability Title

Linux kernel 安全漏洞

Source: CNNVD (China National Vulnerability Database)

Vulnerability Description

Source: CNNVD (China National Vulnerability Database)

CVSS Information

N/A

Source: CNNVD (China National Vulnerability Database)

Vulnerability Type

N/A

Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Linux	Linux	13d2d3d381ee9844f89bd436ab0f44204660027e ~ fe9274027697c69c1430dc7ee568f82b331ef972	-
Linux	Linux	6.8	-

II. Public POCs for CVE-2024-56656

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2024-56656

请登录查看更多情报信息。

Patches & Fixes for CVE-2024-56656 (2)

https://www.cve.org/CVERecord?id=CVE-2024-56656

Same Patch Batch · Linux · 2024-12-27 · 221 CVEs total

CVE-2024-53209	9.8 CRITICAL	bnxt_en: Fix receive ring space parameters when XDP is active
CVE-2024-53206	9.8 CRITICAL	tcp: Fix use-after-free of nreq in reqsk_timer_handler().
CVE-2024-56645	9.8 CRITICAL	can: j1939: j1939_session_new(): fix skb reference counting
CVE-2024-53169	9.8 CRITICAL	nvme-fabrics: fix kernel crash while shutting down controller
CVE-2024-56640	9.8 CRITICAL	net/smc: fix LGR and link use-after-free issue
CVE-2024-53186	9.8 CRITICAL	ksmbd: fix use-after-free in SMB request handling
CVE-2024-53176	9.8 CRITICAL	smb: During unmount, ensure all cached dir instances drop their dentry
CVE-2024-53177	9.8 CRITICAL	smb: prevent use-after-free due to open_cached_dir error paths
CVE-2024-53179	9.8 CRITICAL	smb: client: fix use-after-free of signing key
CVE-2024-56591	8.8 HIGH	Bluetooth: hci_conn: Use disable_delayed_work_sync
CVE-2024-56653	8.8 HIGH	Bluetooth: btmtk: avoid UAF in btmtk_process_coredump
CVE-2024-56651	8.8 HIGH	can: hi311x: hi3110_can_ist(): fix potential use-after-free
CVE-2024-53224	8.8 HIGH	RDMA/mlx5: Move events notifier registration to be after device registration
CVE-2024-53237	8.8 HIGH	Bluetooth: fix use-after-free in device_for_each_child()
CVE-2024-56669	8.8 HIGH	iommu/vt-d: Remove cache tags before disabling ATS
CVE-2024-56626	8.8 HIGH	ksmbd: fix Out-of-Bounds Write in ksmbd_vfs_stream_write
CVE-2024-56627	8.1 HIGH	ksmbd: fix Out-of-Bounds Read in ksmbd_vfs_stream_read
CVE-2024-56604	7.8 HIGH	Bluetooth: RFCOMM: avoid leaving dangling sk pointer in rfcomm_sock_alloc()
CVE-2024-56554	7.8 HIGH	binder: fix freeze UAF in binder_release_work()
CVE-2024-56552	7.8 HIGH	drm/xe/guc_submit: fix race around suspend_pending

Showing top 20 of 221 CVEs. View all on vendor page → →

IV. Related Vulnerabilities

Same product: Linux

Same vendor: Linux

V. Comments for CVE-2024-56656

No comments yet

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2024-56656— bnxt_en: Fix aggregation ID mask to prevent oops on 5760X chips

Quick assessment

Possible ATT&CK Techniques 1 AI

Affected Version Matrix 6

I. Basic Information for CVE-2024-56656

Vulnerability Information

Vulnerability Title

Vulnerability Description

CVSS Information

Vulnerability Type

Vulnerability Title

Vulnerability Description

CVSS Information

Vulnerability Type

Affected Products

II. Public POCs for CVE-2024-56656

III. Intelligence Information for CVE-2024-56656

Patches & Fixes for CVE-2024-56656 (2)

Same Patch Batch · Linux · 2024-12-27 · 221 CVEs total

IV. Related Vulnerabilities

V. Comments for CVE-2024-56656

Leave a comment