CVE-2024-57843
A critical bug in the Linux kernel’s virtio‑net driver can cause a memory overflow that leads to crashes or failures when transferring large files to a virtual machine. The flaw is triggered when a packet fragment is only one page in size and the driver’s DMA buffer overflows the page boundary. The issue has been fixed in recent kernel releases.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Linux kernel users running versions that include the virtio‑net driver before the fix, especially those with the sysctl net.core.high_order_alloc_disable set to 1.
Real-world impact
An attacker could exploit this overflow to crash a virtual machine or disrupt file transfers, effectively causing a denial‑of‑service condition.
Why this severity
The CVSS score of 9.8 reflects that the vulnerability requires no authentication or user interaction, yet it can completely compromise confidentiality, integrity, and availability of the affected system.
What to do about it
- 01Upgrade the Linux kernel to a version that includes the virtio‑net overflow fix (any release after the commit that reverts the problematic changes).
NVD-referenced vendor advisory
Timeline
- Jan 11, 2025 · Jan 11, 2025PublishedDisclosed and added to the National Vulnerability Database.
- Aug 4, 2026 · 2d agoAdvisory updatedThe NVD record was last revised.
- Aug 4, 2026 · 1d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.