{"id":"CVE-2024-53164","state":"PUBLISHED","title":"net: sched: fix ordering of qlen adjustment","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: sched: fix ordering of qlen adjustment\n\nChanges to sch->q.qlen around qdisc_tree_reduce_backlog() need to happen\n_before_ a call to said function because otherwise it may fail to notify\nparent qdiscs when the child is about to become empty.","publishedAt":"2024-12-27T13:38:43.407Z","updatedAt":"2026-10-15T00:58:52.239Z","severity":{"score":7.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"959466588aa7f84ccf79ae36a1d89542eaf9aaec","status":"affected","lessThan":"44782565e1e6174c94bddfa72ac7267cd09c1648","versionType":"git"},{"version":"959466588aa7f84ccf79ae36a1d89542eaf9aaec","status":"affected","lessThan":"5e473f462a16f1a34e49ea4289a667d2e4f35b52","versionType":"git"},{"version":"959466588aa7f84ccf79ae36a1d89542eaf9aaec","status":"affected","lessThan":"33db36b3c53d0fda2699ea39ba72bee4de8336e8","versionType":"git"},{"version":"959466588aa7f84ccf79ae36a1d89542eaf9aaec","status":"affected","lessThan":"489422e2befff88a1de52b2acebe7b333bded025","versionType":"git"},{"version":"959466588aa7f84ccf79ae36a1d89542eaf9aaec","status":"affected","lessThan":"97e13434b5da8e91bdf965352fad2141d13d72d3","versionType":"git"},{"version":"959466588aa7f84ccf79ae36a1d89542eaf9aaec","status":"affected","lessThan":"e3e54ad9eff8bdaa70f897e5342e34b76109497f","versionType":"git"},{"version":"959466588aa7f84ccf79ae36a1d89542eaf9aaec","status":"affected","lessThan":"5eb7de8cd58e73851cd37ff8d0666517d9926948","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/sched/sch_cake.c","net/sched/sch_choke.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"4.14","status":"affected"},{"version":"0","status":"unaffected","lessThan":"4.14","versionType":"semver"},{"version":"5.4.289","status":"unaffected","lessThanOrEqual":"5.4.*","versionType":"semver"},{"version":"5.10.233","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.176","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.122","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.68","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.7","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.13","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/sched/sch_cake.c","net/sched/sch_choke.c"]}],"references":["https://git.kernel.org/stable/c/44782565e1e6174c94bddfa72ac7267cd09c1648","https://git.kernel.org/stable/c/5e473f462a16f1a34e49ea4289a667d2e4f35b52","https://git.kernel.org/stable/c/33db36b3c53d0fda2699ea39ba72bee4de8336e8","https://git.kernel.org/stable/c/489422e2befff88a1de52b2acebe7b333bded025","https://git.kernel.org/stable/c/97e13434b5da8e91bdf965352fad2141d13d72d3","https://git.kernel.org/stable/c/e3e54ad9eff8bdaa70f897e5342e34b76109497f","https://git.kernel.org/stable/c/5eb7de8cd58e73851cd37ff8d0666517d9926948","https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html","https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"weaknesses":[],"ingestedAt":"2026-10-29T20:08:04.920Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/53xxx/CVE-2024-53164.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2024-53164","state":"PUBLISHED","datePublished":"2024-12-27T13:38:43.407Z","dateUpdated":"2026-10-15T00:58:52.239Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2024-11-19T17:17:25.004Z"},"containers":{"cna":{"title":"net: sched: fix ordering of qlen adjustment","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: sched: fix ordering of qlen adjustment\n\nChanges to sch->q.qlen around qdisc_tree_reduce_backlog() need to happen\n_before_ a call to said function because otherwise it may fail to notify\nparent qdiscs when the child is about to become empty."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"959466588aa7f84ccf79ae36a1d89542eaf9aaec","status":"affected","lessThan":"44782565e1e6174c94bddfa72ac7267cd09c1648","versionType":"git"},{"version":"959466588aa7f84ccf79ae36a1d89542eaf9aaec","status":"affected","lessThan":"5e473f462a16f1a34e49ea4289a667d2e4f35b52","versionType":"git"},{"version":"959466588aa7f84ccf79ae36a1d89542eaf9aaec","status":"affected","lessThan":"33db36b3c53d0fda2699ea39ba72bee4de8336e8","versionType":"git"},{"version":"959466588aa7f84ccf79ae36a1d89542eaf9aaec","status":"affected","lessThan":"489422e2befff88a1de52b2acebe7b333bded025","versionType":"git"},{"version":"959466588aa7f84ccf79ae36a1d89542eaf9aaec","status":"affected","lessThan":"97e13434b5da8e91bdf965352fad2141d13d72d3","versionType":"git"},{"version":"959466588aa7f84ccf79ae36a1d89542eaf9aaec","status":"affected","lessThan":"e3e54ad9eff8bdaa70f897e5342e34b76109497f","versionType":"git"},{"version":"959466588aa7f84ccf79ae36a1d89542eaf9aaec","status":"affected","lessThan":"5eb7de8cd58e73851cd37ff8d0666517d9926948","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/sched/sch_cake.c","net/sched/sch_choke.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"4.14","status":"affected"},{"version":"0","status":"unaffected","lessThan":"4.14","versionType":"semver"},{"version":"5.4.289","status":"unaffected","lessThanOrEqual":"5.4.*","versionType":"semver"},{"version":"5.10.233","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.176","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.122","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.68","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.7","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.13","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/sched/sch_cake.c","net/sched/sch_choke.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/44782565e1e6174c94bddfa72ac7267cd09c1648"},{"url":"https://git.kernel.org/stable/c/5e473f462a16f1a34e49ea4289a667d2e4f35b52"},{"url":"https://git.kernel.org/stable/c/33db36b3c53d0fda2699ea39ba72bee4de8336e8"},{"url":"https://git.kernel.org/stable/c/489422e2befff88a1de52b2acebe7b333bded025"},{"url":"https://git.kernel.org/stable/c/97e13434b5da8e91bdf965352fad2141d13d72d3"},{"url":"https://git.kernel.org/stable/c/e3e54ad9eff8bdaa70f897e5342e34b76109497f"},{"url":"https://git.kernel.org/stable/c/5eb7de8cd58e73851cd37ff8d0666517d9926948"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable qdisc hierarchy (cake/choke leaf under a classful parent such as DRR/QFQ/HFSC) is built through rtnetlink RTM_NEWQDISC/RTM_NEWTCLASS and triggered by locally injected traffic on a local device, matching the tc/netlink qdisc local vector.\nAC:L - The attacker fully controls every precondition — the qdisc topology, the cake memlimit / choke limit that forces the drop, and the packet injection — making the miscounted qlen and the resulting stale active class deterministic with no race to win.\nPR:L - tc configuration requires only CAP_NET_ADMIN over the target netns, checked via namespace-relative netlink_net_capable(); an unprivileged user obtains it with `unshare -Urn` and uses the always-present `lo` device.\nUI:N - The attacker performs all steps — creating the qdisc tree, sending packets, and deleting the class — with no action by any other user.\nS:U - The corruption and its consequences remain within the kernel's own security authority; this is standard local kernel privilege escalation with no crossing into a hypervisor or IOMMU boundary.\nC:H - The missed qlen_notify() leaves a freed class linked in the parent's active list/rbtree, and the resulting use-after-free lets the attacker reclaim the slab object and read back attacker-shaped kernel memory, yielding arbitrary kernel read.\nI:H - The same use-after-free provides both a hijackable indirect call through cl->qdisc->ops->peek and unlink-style writes via list_del(&cl->alist)/rb_erase(&cl->el_node), giving control-flow hijack and arbitrary write.\nA:H - The stale class causes an immediate use-after-free oops, and even absent full exploitation the permanently non-dequeuing qdisc wedges all transmission on the device, a complete availability loss."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-08-05T11:44:12.310Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.14","versionEndExcluding":"5.4.289"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.14","versionEndExcluding":"5.10.233"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.14","versionEndExcluding":"5.15.176"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.14","versionEndExcluding":"6.1.122"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.14","versionEndExcluding":"6.6.68"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.14","versionEndExcluding":"6.12.7"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.14","versionEndExcluding":"6.13"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html"},{"url":"https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html"}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2025-11-03T20:46:55.582Z"}},{"affected":[{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP","defaultStatus":"unknown","versions":[{"version":"V3.1.0","status":"affected","lessThan":"V3.1.5","versionType":"custom"}]},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP","defaultStatus":"unknown","versions":[{"version":"V3.1.0","status":"affected","lessThan":"V3.1.5","versionType":"custom"}]},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP","defaultStatus":"unknown","versions":[{"version":"V3.1.0","status":"affected","lessThan":"V3.1.5","versionType":"custom"}]},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP","defaultStatus":"unknown","versions":[{"version":"V3.1.0","status":"affected","lessThan":"V3.1.5","versionType":"custom"}]},{"vendor":"Siemens","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP","defaultStatus":"unknown","versions":[{"version":"V3.1.0","status":"affected","lessThan":"V3.1.5","versionType":"custom"}]}],"references":[{"url":"https://cert-portal.siemens.com/productcert/html/ssa-398330.html"}],"providerMetadata":{"shortName":"siemens-SADP","orgId":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","dateUpdated":"2026-10-15T00:58:52.239Z"},"x_adpType":"supplier"}]}}}