CVE-2024-35884 – A Linux kernel vulnerability in UDP packet hand... (How to Fix)

Q: What is the severity of CVE-2024-35884?

CVE-2024-35884 has a CVSS score of 5.5 (MEDIUM). A Linux kernel vulnerability in UDP packet handling can cause kernel crashes or packet corruption when UDP Generic Segmentation Offload (GSO) packets are incorrectly processed in tunneled network configurations. This affects systems with rx-udp-gro-forwarding or rx-gro-list enabled, particularly those using UDP-based tunnels like Geneve. Network administrators and organizations using Linux-based networking infrastructure are affected.

📋 TL;DR

A Linux kernel vulnerability in UDP packet handling can cause kernel crashes or packet corruption when UDP Generic Segmentation Offload (GSO) packets are incorrectly processed in tunneled network configurations. This affects systems with rx-udp-gro-forwarding or rx-gro-list enabled, particularly those using UDP-based tunnels like Geneve. Network administrators and organizations using Linux-based networking infrastructure are affected.

💻 Affected Systems

Products:

Linux Kernel

Versions: Multiple stable kernel versions before fixes were applied (specific versions in git commits provided)

Operating Systems: Linux distributions using affected kernel versions

Default Config Vulnerable: ✅ No

Notes: Requires rx-udp-gro-forwarding or rx-gro-list enabled AND UDP tunnel usage (like Geneve). Not vulnerable in default configurations.

📦 What is this software?

Debian Linux by Debian

View all CVEs affecting Debian Linux →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Kernel panic leading to system crash and denial of service, potentially affecting multiple systems in a network infrastructure.

🟠

Likely Case

Network packet corruption causing connectivity issues, degraded performance, or application failures in tunneled network environments.

🟢

If Mitigated

Minor performance impact from disabling GRO features or segmentation overhead when workarounds are applied.

🌐 Internet-Facing: MEDIUM - Requires specific network configuration and UDP tunnel usage, but could affect exposed network gateways.

🏢 Internal Only: MEDIUM - Affects internal network infrastructure and virtualization platforms using UDP tunnels.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ⚠️ Yes

Complexity: MEDIUM

Exploitation requires network access and specific UDP tunnel configurations. The vulnerability was discovered through normal kernel development/testing.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Multiple stable kernel versions with commits: 3001e7aa43d6, 3391b157780b, 35fe0e0b5c00, 3d010c8031e3, d12245080cb2

Vendor Advisory: https://git.kernel.org/stable/c/3001e7aa43d6691db2a878b0745b854bf12ddd19

Restart Required: Yes

Instructions:

1. Update Linux kernel to patched version from your distribution vendor. 2. Reboot system to load new kernel. 3. Verify kernel version matches patched release.

🔧 Temporary Workarounds

Disable UDP GRO forwarding

linux

Prevent UDP packets from being GROed when forwarded, eliminating the vulnerable condition

sysctl -w net.ipv4.udp_rmem_min=131072
sysctl -w net.ipv4.udp_wmem_min=131072
echo 0 > /proc/sys/net/ipv4/udp_gro_forwarding

Disable GRO on tunnel interfaces

linux

Turn off Generic Receive Offload on tunnel network interfaces

ethtool -K <tunnel_interface> gro off

🧯 If You Can't Patch

Disable rx-udp-gro-forwarding and rx-gro-list features in network configuration
Avoid using UDP-based tunnels (Geneve, VXLAN) or ensure they operate without GRO features

🔍 How to Verify

Check if Vulnerable:

Check if rx-udp-gro-forwarding is enabled: cat /proc/sys/net/ipv4/udp_gro_forwarding. If 1 and using UDP tunnels, system may be vulnerable.

Check Version:

uname -r

Verify Fix Applied:

Check kernel version against patched releases and verify UDP GRO forwarding behavior with network testing.

📡 Detection & Monitoring

Log Indicators:

Kernel panic messages
BUG_ON errors in kernel logs
Network interface errors
UDP packet corruption logs

Network Indicators:

UDP tunnel connectivity failures
Increased packet retransmissions
Geneve/VXLAN tunnel performance degradation

SIEM Query:

source="kernel" AND ("BUG_ON" OR "skb_segment" OR "udp_gro" OR "kernel panic")

📊 Metadata

CVE ID: CVE-2024-35884

CVSS v3 Score: 5.5 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE: CWE-617

Published: May 19, 2024

Last Updated: December 23, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2024-35884, you might also want to check these: