Security readout for executives and security teams
Plain-English summary
A low-privileged local user could submit an undersized Ethernet frame through an affected Linux TAP/XDP path. Missing length validation may corrupt network-buffer handling, leading to out-of-bounds access or inconsistent packet metadata. The supplied CVSS score is 8.8, reflecting potentially high confidentiality, integrity, and availability impact.
Executive priority
Treat this as a prompt patching priority for systems where lower-privileged local users can access TAP/XDP processing. Purely remote exposure is not supported by the supplied evidence. Escalate uncertain kernel builds to engineering because the provided affected-version representation is ambiguous.
Technical view
The tun_xdp_one() path failed to reject IFF_TAP frames shorter than ETH_HLEN before calling eth_type_trans(). This can create a corrupted skb, permit Ethernet-header access beyond the actual frame, or send inconsistent length metadata downstream. The resolution adds the same short-frame rejection already present in tun_get_user().
Likely exposure
Potentially exposed systems run a vulnerable Linux kernel and permit a low-privileged local actor to reach TAP/XDP processing. The bundle's flattened version list does not clearly distinguish affected ranges from correction boundaries, so exposure should not be inferred from version strings alone.
Exploitation context
The CVSS vector describes local, low-complexity exploitation requiring low privileges and no user interaction. The CVE is not listed in KEV, and no supplied source establishes active exploitation or a public exploit. This is absence of supporting evidence, not proof that exploitation has never occurred.
Researcher notes
The alternate tun_get_user() path already rejected undersized IFF_TAP frames; tun_xdp_one() lacked equivalent validation. The correction drops those frames before eth_type_trans(). No CWE is assigned. Practical reachability, distribution backports, and exact affected ranges require build-specific verification.
Mitigation direction
- Apply vendor or distribution kernel updates incorporating the referenced stable-kernel correction.
- Prioritize systems where low-privileged users can access TAP/XDP networking paths.
- If updates are delayed, consult Linux or distribution guidance for supported mitigations; none are specified here.
- Limit unnecessary local access to affected systems pending updates.
Validation and detection
- Inventory running kernel builds and systems configured with TAP interfaces or XDP processing.
- Compare each kernel build against distribution advisories and inclusion of the referenced correction.
- Confirm updated systems were restarted into the corrected kernel.
- Use authorized regression testing to confirm tun_xdp_one rejects frames shorter than the Ethernet header.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2024-41091 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H26LinuxVulnerability scoring details
Base CVSS 3.1 score
8.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/32b0aaba5dbc85816898167d9b5d45a22eae82e9CVE reference, Linux
- https://git.kernel.org/stable/c/6100e0237204890269e3f934acfc50d35fd6f319CVE reference, Linux
- https://git.kernel.org/stable/c/589382f50b4a5d90d16d8bc9dcbc0e927a3e39b2CVE reference, Linux
- https://git.kernel.org/stable/c/ad6b3f622ccfb4bfedfa53b6ebd91c3d1d04f146CVE reference, Linux
- https://git.kernel.org/stable/c/d5ad89b7d01ed4e66fd04734fc63d6e78536692aCVE reference, Linux
- https://git.kernel.org/stable/c/a9d1c27e2ee3b0ea5d40c105d6e728fc114470bbCVE reference, Linux
- https://git.kernel.org/stable/c/8418f55302fa1d2eeb73e16e345167e545c598a5CVE reference, Linux
- https://git.kernel.org/stable/c/049584807f1d797fc3078b68035450a9769eb5c3CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/01/msg00001.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.