CVE-2024-50039 – This CVE describes a Linux kernel vulnerability... (How to Fix)

Q: What is the severity of CVE-2024-50039?

CVE-2024-50039 has a CVSS score of 5.5 (MEDIUM). This CVE describes a Linux kernel vulnerability in the network traffic control subsystem where allowing TCA_STAB (size table) configuration on non-root qdiscs can cause a NULL pointer dereference. Attackers with local access can crash the system by configuring specific qdisc combinations. This affects Linux systems using traffic shaping with SFQ and TBF qdiscs.

📋 TL;DR

This CVE describes a Linux kernel vulnerability in the network traffic control subsystem where allowing TCA_STAB (size table) configuration on non-root qdiscs can cause a NULL pointer dereference. Attackers with local access can crash the system by configuring specific qdisc combinations. This affects Linux systems using traffic shaping with SFQ and TBF qdiscs.

💻 Affected Systems

Products:

Linux kernel

Versions: Versions before fixes in stable trees (specific commits listed in references)

Operating Systems: Linux distributions using affected kernel versions

Default Config Vulnerable: ✅ No

Notes: Only vulnerable when unprivileged users can configure network qdiscs or when processes have CAP_NET_ADMIN capability.

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Local denial of service causing kernel panic and system crash, potentially leading to data loss or service disruption.

🟠

Likely Case

Local denial of service requiring system reboot to recover.

🟢

If Mitigated

No impact if proper access controls prevent unprivileged users from configuring network qdiscs.

🌐 Internet-Facing: LOW - Requires local access to exploit, not remotely exploitable.

🏢 Internal Only: MEDIUM - Local users or processes with CAP_NET_ADMIN can trigger the crash.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: LOW - Simple configuration of specific qdisc combinations triggers the bug.

Exploitation requires CAP_NET_ADMIN capability or root access to configure network traffic control.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Patched in stable kernel trees via commits referenced in CVE

Vendor Advisory: https://git.kernel.org/stable/c/1edf039ee01788ffc25625fe58a903ae2efa213e

Restart Required: Yes

Instructions:

1. Update Linux kernel to patched version from your distribution. 2. Reboot system to load new kernel. 3. Verify kernel version with 'uname -r'.

🔧 Temporary Workarounds

Restrict qdisc configuration

linux

Prevent unprivileged users from configuring network qdiscs by removing CAP_NET_ADMIN capability.

setcap -r CAP_NET_ADMIN /path/to/application
capsh --drop=cap_net_admin -- -c 'your_command'

🧯 If You Can't Patch

Restrict CAP_NET_ADMIN capability to trusted processes only
Implement strict access controls on network configuration interfaces

🔍 How to Verify

Check if Vulnerable:

Check kernel version and if unpatched, test by attempting to configure TCA_STAB on non-root qdiscs (requires CAP_NET_ADMIN).

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version is updated to include the fix commits, or test that TCA_STAB configuration on non-root qdiscs is rejected.

📡 Detection & Monitoring

Log Indicators:

Kernel panic logs mentioning NULL pointer dereference in sfq_dequeue
System crash/reboot events following network configuration changes

Network Indicators:

Unusual traffic control configuration attempts

SIEM Query:

source="kernel" AND "NULL pointer dereference" AND "sfq_dequeue"

📊 Metadata

CVE ID: CVE-2024-50039

CVSS v3 Score: 5.5 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE: CWE-476

Published: October 21, 2024

Last Updated: November 3, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2024-50039, you might also want to check these: