{"id":"DEBIAN-CVE-2024-49980","details":"In the Linux kernel, the following vulnerability has been resolved:  vrf: revert \"vrf: Remove unnecessary RCU-bh critical section\"  This reverts commit 504fc6f4f7f681d2a03aa5f68aad549d90eab853.  dev_queue_xmit_nit is expected to be called with BH disabled. __dev_queue_xmit has the following:          /* Disable soft irqs for various locks below. Also          * stops preemption for RCU.          */         rcu_read_lock_bh();  VRF must follow this invariant. The referenced commit removed this protection. Which triggered a lockdep warning:  \t================================ \tWARNING: inconsistent lock state \t6.11.0 #1 Tainted: G        W \t-------------------------------- \tinconsistent {IN-SOFTIRQ-W} -\u003e {SOFTIRQ-ON-W} usage. \tbtserver/134819 [HC0[0]:SC0[0]:HE1:SE1] takes: \tffff8882da30c118 (rlock-AF_PACKET){+.?.}-{2:2}, at: tpacket_rcv+0x863/0x3b30 \t{IN-SOFTIRQ-W} state was registered at: \t  lock_acquire+0x19a/0x4f0 \t  _raw_spin_lock+0x27/0x40 \t  packet_rcv+0xa33/0x1320 \t  __netif_receive_skb_core.constprop.0+0xcb0/0x3a90 \t  __netif_receive_skb_list_core+0x2c9/0x890 \t  netif_receive_skb_list_internal+0x610/0xcc0           [...]  \tother info that might help us debug this: \t Possible unsafe locking scenario:  \t       CPU0 \t       ---- \t  lock(rlock-AF_PACKET); \t  \u003cInterrupt\u003e \t    lock(rlock-AF_PACKET);  \t *** DEADLOCK ***  \tCall Trace: \t \u003cTASK\u003e \t dump_stack_lvl+0x73/0xa0 \t mark_lock+0x102e/0x16b0 \t __lock_acquire+0x9ae/0x6170 \t lock_acquire+0x19a/0x4f0 \t _raw_spin_lock+0x27/0x40 \t tpacket_rcv+0x863/0x3b30 \t dev_queue_xmit_nit+0x709/0xa40 \t vrf_finish_direct+0x26e/0x340 [vrf] \t vrf_l3_out+0x5f4/0xe80 [vrf] \t __ip_local_out+0x51e/0x7a0           [...]","modified":"2026-09-15T09:03:15.261968848Z","published":"2024-10-21T18:15:18.613Z","upstream":["CVE-2024-49980"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2024-49980"}],"affected":[{"package":{"name":"linux","ecosystem":"Debian:13","purl":"pkg:deb/debian/linux?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.11.4-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2024-49980.json"}},{"package":{"name":"linux","ecosystem":"Debian:14","purl":"pkg:deb/debian/linux?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.11.4-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2024-49980.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}]}