Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
AV AC PR UI S C I A CVSS EPSS %ile KEV L L L N U N N H 5.5 .0031 23.3 —
AFFECTED Product Versions Fixed Linux 54f00cce11786742bd11e5e68c3bf85e6dc048c9 – — Linux 6.6 – 6.6.59
TIMELINE Mar 6 Reserved by Linux Apr 29 Published (CNA: Linux) Aug 4 RESCORED — CVE-2024-58099 (Linux). CVSS 8.6 → 5.5 (NVD).
In the Linux kernel, the following vulnerability has been resolved: vmxnet3: Fix packet corruption in vmxnet3_xdp_xmit_frame Andrew and Nikolay reported connectivity issues with Cilium's service load-balancing in case of vmxnet3. If a BPF program for native XDP adds an encapsulation header such as IPIP and transmits the packet out the same interface, then in case of vmxnet3 a corrupted packet is being sent and subsequently dropped on the path. vmxnet3_xdp_xmit_frame() which is called e.g. via vmxnet3_run_xdp() through vmxnet3_xdp_xmit_back() calculates an incorrect DMA address: page = virt_to_page(xdpf->data); tbi->dma_addr = page_pool_get_dma_addr(page) + VMXNET3_XDP_HEADROOM; dma_sync_single_for_device(&adapter->pdev->dev, tbi->dma_addr, buf_size, DMA_TO_DEVICE); The above assumes a fixed offset (VMXNET3_XDP_HEADROOM), but the XDP BPF program could have moved xdp->data. While the passed buf_size is correct (xdpf->len), the dma_addr needs to have a dynamic offset which can be calculated as xdpf->data - (void *)xdpf, that is, xdp->data - xdp->data_hard_start.
| Date | Event | Detail |
|---|---|---|
| March 6, 2025 | Reserved | Reserved by Linux |
| April 29, 2025 | Published | Published (CNA: Linux) |
| August 4, 2026 | RESCORED | RESCORED — CVE-2024-58099 (Linux). CVSS 8.6 → 5.5 (NVD). |
Authoritative record: CVE-2024-58099 at cve.org
Vendors: linux
Weaknesses: CWE-787
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2024-58099 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.