Answer in brief
CVE-2024-58099 records a Unknown severity vulnerability in vmxnet3: Fix packet corruption in vmxnet3_xdp_xmit_frame. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=54f00cce11786742bd11e5e68c3bf85e6dc048c9 <59ba6cdadb9c26b606a365eb9c9b25eb2052622d || >=54f00cce11786742bd11e5e68c3bf85e6dc048c9 <f82eb34fb59a8fb96c19f4f492c20eb774140bb5 || >=54f00cce11786742bd11e5e68c3bf85e6dc048c9 <4678adf94da4a9e9683817b246b58ce15fb81782 | 59ba6cdadb9c26b606a365eb9c9b25eb2052622d, f82eb34fb59a8fb96c19f4f492c20eb774140bb5, 4678adf94da4a9e9683817b246b58ce15fb81782 |
| Linux/Linuxgeneric | 6.6 | Not reported |
Published upstream
Apr 29, 2025
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 5, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 5, 2026
In the Linux kernel, the following vulnerability has been resolved: vmxnet3: Fix packet corruption in vmxnet3_xdp_xmit_frame Andrew and Nikolay reported connectivity issues with Cilium's service load-balancing in case of vmxnet3. If a BPF program for native XDP adds an encapsulation header such as IPIP and transmits the packet out the same interface, then in case of vmxnet3 a corrupted packet is being sent and subsequently dropped on the path. vmxnet3_xdp_xmit_frame() which is called e.g. via vmxnet3_run_xdp() through vmxnet3_xdp_xmit_back() calculates an incorrect DMA address: page = virt_to_page(xdpf->data); tbi->dma_addr = page_pool_get_dma_addr(page) + VMXNET3_XDP_HEADROOM; dma_sync_single_for_device(&adapter->pdev->dev, tbi->dma_addr, buf_size, DMA_TO_DEVICE); The above assumes a fixed offset (VMXNET3_XDP_HEADROOM), but the XDP BPF program could have moved xdp->data. While the passed buf_size is correct (xdpf->len), the dma_addr needs to have a dynamic offset which can be calculated as xdpf->data - (void *)xdpf, that is, xdp->data - xdp->data_hard_start.
Quoted source text, attributed separately from HOL analysis.
Answer in brief
CVE-2024-58099 records a Unknown severity vulnerability in vmxnet3: Fix packet corruption in vmxnet3_xdp_xmit_frame. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=54f00cce11786742bd11e5e68c3bf85e6dc048c9 <59ba6cdadb9c26b606a365eb9c9b25eb2052622d || >=54f00cce11786742bd11e5e68c3bf85e6dc048c9 <f82eb34fb59a8fb96c19f4f492c20eb774140bb5 || >=54f00cce11786742bd11e5e68c3bf85e6dc048c9 <4678adf94da4a9e9683817b246b58ce15fb81782 | 59ba6cdadb9c26b606a365eb9c9b25eb2052622d, f82eb34fb59a8fb96c19f4f492c20eb774140bb5, 4678adf94da4a9e9683817b246b58ce15fb81782 |
| Linux/Linuxgeneric | 6.6 | Not reported |
Published upstream
Apr 29, 2025
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 5, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 5, 2026
In the Linux kernel, the following vulnerability has been resolved: vmxnet3: Fix packet corruption in vmxnet3_xdp_xmit_frame Andrew and Nikolay reported connectivity issues with Cilium's service load-balancing in case of vmxnet3. If a BPF program for native XDP adds an encapsulation header such as IPIP and transmits the packet out the same interface, then in case of vmxnet3 a corrupted packet is being sent and subsequently dropped on the path. vmxnet3_xdp_xmit_frame() which is called e.g. via vmxnet3_run_xdp() through vmxnet3_xdp_xmit_back() calculates an incorrect DMA address: page = virt_to_page(xdpf->data); tbi->dma_addr = page_pool_get_dma_addr(page) + VMXNET3_XDP_HEADROOM; dma_sync_single_for_device(&adapter->pdev->dev, tbi->dma_addr, buf_size, DMA_TO_DEVICE); The above assumes a fixed offset (VMXNET3_XDP_HEADROOM), but the XDP BPF program could have moved xdp->data. While the passed buf_size is correct (xdpf->len), the dma_addr needs to have a dynamic offset which can be calculated as xdpf->data - (void *)xdpf, that is, xdp->data - xdp->data_hard_start.
Quoted source text, attributed separately from HOL analysis.