CVE-2024-57936
A critical flaw in the Linux kernel's RDMA/bnxt_re driver incorrectly reports the maximum number of scatter-gather elements (SGEs) for work requests can lead to traffic, allowing requests that exceed the hardware's capability and causing system crashes or traffic failures. The issue has been resolved in the kernel by fixing the max SGE limit to match what the hardware supports. Users should apply the kernel patch or upgrade to a kernel version that includes this fix.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Linux kernel users, particularly those using RDMA/bnxt_re devices.
Real-world impact
Potential denial of service through system crashes or network traffic disruption.
Why this severity
CVSS 3.1 base score 9.8 (Critical) due to network‑adjacent, low‑complexity attack with no privileges or user interaction required, leading to full compromise of confidentiality, integrity, and availability.
What to do about it
- 01Obtain the Linux kernel patch that fixes the RDMA/bnxt_re max SGEs issue (as referenced in the NVD description).
- 02Apply the patch to the affected kernel or upgrade to a kernel version that includes this fix.
- 03Reboot the system to ensure the updated kernel is loaded.
NVD-referenced vendor advisory (the NVD description states the vulnerability has been resolved in the Linux kernel).
Timeline
- Jan 21, 2025 · Jan 21, 2025PublishedDisclosed and added to the National Vulnerability Database.
- Aug 4, 2026 · 2d agoAdvisory updatedThe NVD record was last revised.
- Aug 4, 2026 · 1d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.