CVE-2024-27026

A flaw was found in the Linux kernel's vmxnet3 network driver. When processing incoming packets under eXpress Data Path (XDP), the driver incorrectly calculates packet buffer lengths, leading to missing reserved tailroom. An attacker could exploit this issue by transmitting network traffic through the affected interface, triggering driver errors and leading to a Denial of Service (DoS).

This vulnerability is rated with a Low severity because triggering the issue requires an eXpress Data Path (XDP) program to be explicitly attached to the virtual network interface, which is not part of standard default configurations. Additionally, enterprise kernels in Red Hat Enterprise Linux 8 and 9 do not include the vulnerable XDP tailroom calculation logic in the vmxnet3 driver. In environments where the affected driver code is present, a denial of service is limited to the local guest kernel handling the virtual network adapter.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.