Security readout for executives and security teams
Plain-English summary
A flaw in the Linux mlx5e network driver can corrupt an internal queue when SHAMPO processing handles a late completion reporting zero consumed strides. Corruption occurs because an already-removed work item is removed again. The supplied CVSS rating is 9.8, but the sources do not establish practical consequences or real-world exploitation.
Executive priority
Treat as an urgent validation and patching item for Linux hosts using relevant mlx5e networking. Prioritize exposed or business-critical systems, while avoiding assumptions that every Linux host is affected. The critical score warrants prompt action, but exploitation evidence and concrete operational impact remain incomplete.
Technical view
After all strides in a WQE are consumed, mlx5e removes it from the work-queue linked list. SHAMPO may subsequently produce another CQE for that WQE with zero consumed strides, causing a second unlink and linked-list corruption. The kernel fix accepts zero-sized consumed strides without unlinking the WQE again.
Likely exposure
Exposure is most likely on systems running affected Linux kernels where the mlx5e driver and SHAMPO receive path are used. The supplied version data names 5.16, 6.1.105, 6.6.46, 6.10.5, and 6.11, but includes ambiguous entries; confirm affected ranges and backports with the distribution vendor.
Exploitation context
The bundle marks this CVE as absent from KEV and provides no evidence of active exploitation or a public exploit. Although the supplied CVSS vector describes network-accessible, unauthenticated impact, the sources do not explain attacker control, prerequisites, reliability, or demonstrated confidentiality, integrity, and availability effects.
Researcher notes
The core invariant failure is a duplicate mlx5_wq_ll_pop() after a WQE was fully consumed and unlinked. A later SHAMPO CQE with zero consumed strides triggers the invalid second unlink. The fix suppresses unlinking for that zero-sized case. No CWE, proof of exploitation, detailed trigger conditions, or reliable impact demonstration is supplied.
Mitigation direction
- Upgrade to a vendor-supported kernel containing the referenced upstream fix or an approved backport.
- Consult the Linux distribution advisory for precise affected and fixed package versions.
- Prioritize systems using mlx5e and SHAMPO until their patch status is confirmed.
- If immediate upgrading is impossible, request vendor-supported feature-specific mitigation guidance.
Validation and detection
- Record the running kernel and installed distribution kernel package versions.
- Determine whether the mlx5e driver and SHAMPO receive path are present and active.
- Verify the vendor kernel includes the relevant fix or documented backport.
- Review kernel and network-driver telemetry for queue corruption, faults, or unexplained instability.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2024-44970 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9LinuxVulnerability scoring details
Base CVSS 3.1 score
9.8CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/7b379353e9144e1f7460ff15f39862012c9d0d78CVE reference, Linux
- https://git.kernel.org/stable/c/650e24748e1e0a7ff91d5c72b72a2f2a452b5b76CVE reference, Linux
- https://git.kernel.org/stable/c/50d8009a0ac02c3311b23a0066511f8337bd88d9CVE reference, Linux
- https://git.kernel.org/stable/c/fba8334721e266f92079632598e46e5f89082f30CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/01/msg00001.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.