CVE-2024-57932
A critical flaw in the Linux kernel’s GVE driver can cause a divide‑by‑zero crash when an XDP program is not loaded or the interface is down. The bug arises from the XDP transmit callback accessing uninitialized data. The issue has been fixed in the kernel.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Linux kernel 6.13 and earlier versions that include the GVE driver. System administrators running these kernels on servers or devices that use GVE virtual Ethernet.
Real-world impact
An attacker could crash the kernel, causing a denial of service, by sending traffic that triggers the XDP transmit path on a vulnerable interface.
Why this severity
The CVSS score of 9.8 reflects the high impact of a complete denial of service with no authentication or user interaction required. The vulnerability allows an attacker to crash the kernel from the network, affecting confidentiality, integrity, and availability.
What to do about it
- 011. Upgrade the Linux kernel to a version that includes the fix (e.g., 6.13 or later).
- 022. Reboot the system to load the new kernel.
NVD description indicates the vulnerability has been resolved in the Linux kernel.
Timeline
- Jan 21, 2025 · Jan 21, 2025PublishedDisclosed and added to the National Vulnerability Database.
- Aug 4, 2026 · 2d agoAdvisory updatedThe NVD record was last revised.
- Aug 4, 2026 · 1d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.