{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-06-11T06:00:50.355","vulnerabilities":[{"cve":{"id":"CVE-2024-41088","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2024-07-29T16:15:04.217","lastModified":"2025-11-03T22:17:32.440","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ncan: mcp251xfd: fix infinite loop when xmit fails\n\nWhen the mcp251xfd_start_xmit() function fails, the driver stops\nprocessing messages, and the interrupt routine does not return,\nrunning indefinitely even after killing the running application.\n\nError messages:\n[  441.298819] mcp251xfd spi2.0 can0: ERROR in mcp251xfd_start_xmit: -16\n[  441.306498] mcp251xfd spi2.0 can0: Transmit Event FIFO buffer not empty. (seq=0x000017c7, tef_tail=0x000017cf, tef_head=0x000017d0, tx_head=0x000017d3).\n... and repeat forever.\n\nThe issue can be triggered when multiple devices share the same SPI\ninterface. And there is concurrent access to the bus.\n\nThe problem occurs because tx_ring->head increments even if\nmcp251xfd_start_xmit() fails. Consequently, the driver skips one TX\npackage while still expecting a response in\nmcp251xfd_handle_tefif_one().\n\nResolve the issue by starting a workqueue to write the tx obj\nsynchronously if err = -EBUSY. In case of another error, decrement\ntx_ring->head, remove skb from the echo stack, and drop the message.\n\n[mkl: use more imperative wording in patch description]"},{"lang":"es","value":"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: can: mcp251xfd: corrige el bucle infinito cuando falla xmit Cuando falla la función mcp251xfd_start_xmit(), el controlador deja de procesar mensajes y la rutina de interrupción no regresa, ejecutándose indefinidamente incluso después de finalizar el aplicación en ejecución. Mensajes de error: [441.298819] mcp251xfd spi2.0 can0: ERROR en mcp251xfd_start_xmit: -16 [441.306498] mcp251xfd spi2.0 can0: El búfer FIFO de evento de transmisión no está vacío. (seq=0x000017c7, tef_tail=0x000017cf, tef_head=0x000017d0, tx_head=0x000017d3). ... y repetir para siempre. El problema puede desencadenarse cuando varios dispositivos comparten la misma interfaz SPI. Y hay acceso simultáneo al autobús. El problema ocurre porque tx_ring->head incrementa incluso si falla mcp251xfd_start_xmit(). En consecuencia, el controlador omite un paquete TX mientras espera una respuesta en mcp251xfd_handle_tefif_one(). Resuelva el problema iniciando una cola de trabajo para escribir el obj tx sincrónicamente si err = -EBUSY. En caso de otro error, disminuya tx_ring->head, elimine skb de la pila de eco y elimine el mensaje. [mkl: utilice una redacción más imperativa en la descripción del parche]"}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":3.6}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-835"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.10","versionEndExcluding":"6.1.97","matchCriteriaId":"0D1B1C19-B25B-4A8A-904D-D71AC2162CE0"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.2","versionEndExcluding":"6.6.37","matchCriteriaId":"D72E033B-5323-4C4D-8818-36E1EBC3535F"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.7","versionEndExcluding":"6.9.8","matchCriteriaId":"E95105F2-32E3-4C5F-9D18-7AEFD0E6275C"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/3e72558c1711d524e3150103739ddd06650e291b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/6c6b4afa59c2fb4d1759235f866d8caed2aa4729","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/d8fb63e46c884c898a38f061c2330f7729e75510","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/f926c022ebaabf7963bebf89a97201d66978a025","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/3e72558c1711d524e3150103739ddd06650e291b","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/6c6b4afa59c2fb4d1759235f866d8caed2aa4729","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/d8fb63e46c884c898a38f061c2330f7729e75510","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/f926c022ebaabf7963bebf89a97201d66978a025","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"]},{"url":"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html","source":"af854a3a-2127-422b-91ae-364da2661108"}]}}]}