What’s Vulnerable › Vulnerabilities

CVE-2024-46681: pktgen: use cpus_read_lock() in pg_net_init()

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-09-13 · updated 2026-10-30

Description

In the Linux kernel, the following vulnerability has been resolved: pktgen: use cpus_read_lock() in pg_net_init() I have seen the WARN_ON(smp_processor_id() != cpu) firing in pktgen_thread_worker() during tests. We must use cpus_read_lock()/cpus_read_unlock() around the for_each_online_cpu(cpu) loop. While we are at it use WARN_ON_ONCE() to avoid a possible syslog flood.

Affected products

• Linux kernel: from 2.6.12 before 6.10.8; 6.11-rc1, 6.11-rc2, 6.11-rc3, 6.11-rc4, 6.11-rc5 — fixed in 6.10.8
• Linux: 2.6.12 — fixed in 6.11

How to fix

Upgrade to a fixed version: Linux kernel 6.10.8; Linux 6.11. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/1b4fe364b561b952dd7beeba7f7616f9a419b83a
• https://git.kernel.org/stable/c/5f5f7366dda8ae870e8305d6e7b3c0c2686cd2cf
• https://git.kernel.org/stable/c/7eed5b3115ce9e057bf64c3f6be9ea72f8298e4e
• https://git.kernel.org/stable/c/979b581e4c69257acab1af415ddad6b2d78a2fa5

Get alerted when CVE-2024-46681 or the next vulnerability affects your stack