CVE-2024-42162High· 7.8▾ Twilight

gve: Account for stopped queues when reading NIC stats

In the Linux kernel, the following vulnerability has been resolved: gve: Account for stopped queues when reading NIC stats We now account for the fact that the NIC might send us stats for a subset of queues. Without this change, gve_ge…

▾ Twilight zone — High severity, or a signal on a lesser flaw

Depth score43/ 100 · Moderate

impact 42.9 · likelihood 0.1 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

Jul 30, 2024

Updated

Oct 21, 2026

CVSS

7.8

Vendor

Linux

Product

Linux

CWE

—

Depth score

43 · Moderate

EPSS

0.31% · p23

Platforms

—

Source

CVEORG

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

decided 2024-09-10

Exploitation: none
Automatable: no
Technical impact: partial

Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.

EPSS history

Exploit-prediction probability, daily snapshots since Oct 21.

0.2% → 0.3%▲ 0.10%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

4 events · 818 days

Jul 30, 2024Published
Disclosed via CVEORG
Oct 21, 2026Record revised
Last analysed / modified upstream
Oct 21, 2026EPSS first tracked
0.2%
Oct 26, 2026EPSS peak
0.2% → 0.3%

Linux #cve.org

Affected

Linux >= 2f523dc34ac8c355609e9b847852bf25bbdb30bf < acf609843a848e2c22ccce98eef109330403380d
Linux >= 2f523dc34ac8c355609e9b847852bf25bbdb30bf < 32675d828c8a392e20d5b42375ed112c407e4b62
Linux >= 2f523dc34ac8c355609e9b847852bf25bbdb30bf < af9bcf910b1f86244f39e15e701b2dc564b469a6
Linux 5.10

Full technical detail▾

Overview

In the Linux kernel, the following vulnerability has been resolved:

gve: Account for stopped queues when reading NIC stats

We now account for the fact that the NIC might send us stats for a subset of queues. Without this change, gve_get_ethtool_stats might make an invalid access on the priv->stats_report->stats array.

Affected

Linux >= 2f523dc34ac8c355609e9b847852bf25bbdb30bf < acf609843a848e2c22ccce98eef109330403380d
Linux >= 2f523dc34ac8c355609e9b847852bf25bbdb30bf < 32675d828c8a392e20d5b42375ed112c407e4b62
Linux >= 2f523dc34ac8c355609e9b847852bf25bbdb30bf < af9bcf910b1f86244f39e15e701b2dc564b469a6
Linux 5.10

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

References

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#cve.org

gve: Account for stopped queues when reading NIC stats

▾ Twilight zone — High severity, or a signal on a lesser flaw

Depth score43/ 100 · Moderate

impact 42.9 · likelihood 0.1 · exploitation 0

Overview

In the Linux kernel, the following vulnerability has been resolved:

gve: Account for stopped queues when reading NIC stats

We now account for the fact that the NIC might send us stats for a subset of queues. Without this change, gve_get_ethtool_stats might make an invalid access on the priv->stats_report->stats array.