ethtool: fail closed if we can't get max channel used in indirection tables
CVE-2024-46834 · published 27 Sept 2024
How serious is it
- Severity: high, CVSS score 7.8 out of 10.
- No exploit prediction (EPSS) score yet.
- Not on the CISA list of exploited vulnerabilities.
- No public exploit in Exploit-DB.
Is your app affected by CVE-2024-46834?
Paste this prompt into Claude Code, Cursor or any AI coding tool: it runs a free Shippable scan of your project and fixes what it finds. Built with Lovable, Bolt or v0? Scan your live app. Or upload your package file.
Who is affected
- Linux Linux: d4ab4286276fcd6c155bafdf4422b712068d2516 to < 7e6ff8c58985fbe20d131112aba0a8867cdedc59, d4ab4286276fcd6c155bafdf4422b712068d2516 to < 101737d8b88dbd4be6010bac398fe810f1950036, d4ab4286276fcd6c155bafdf4422b712068d2516 to < 2899d58462ba868287d6ff3acad3675e7adf934f
- Linux Linux: 4.6
How to check
- Find out whether you run the affected product and which version, then compare it with the versions above.
How to fix
Copies a prompt for Claude Code, Cursor or Codex that asks it to check whether you run this product.
- Apply the vendor's update or mitigation from the references below. If there is none yet, limit exposure of the affected service until there is.
- If a vulnerable version was live, check your logs and rotate the secrets that server could read.
The advisory
In the Linux kernel, the following vulnerability has been resolved:
ethtool: fail closed if we can't get max channel used in indirection tables
Commit 0d1b7d6c9274 ("bnxt: fix crashes when reducing ring count with
active RSS contexts") proves that allowing indirection table to contain
channels with out of bounds IDs may lead to crashes. Currently the
max channel check in the core gets skipped if driver can't fetch
the indirection table or when we can't allocate memory.
Both of those conditions should be extremely rare but if they do
happen we should try to be safe and fail the channel change.
Check your whole app
Dependencies are only half of it. Free and read-only: before you push, run npx shippable-dev scan localhost:3000 in your project folder, no account needed. For your live app, you prove it's yours with a one-line tag first.
References
- git.kernel.org/stable/c/7e6ff8c58985fbe20d131112aba0a8867cdedc59
- git.kernel.org/stable/c/101737d8b88dbd4be6010bac398fe810f1950036
- git.kernel.org/stable/c/2899d58462ba868287d6ff3acad3675e7adf934f
Merged from CVE List. Last updated 25 Oct 2026. All vulnerabilities · RSS · JSON