---
id: CVE-2024-42154
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  tcp_metrics: validate source addr length

  I don't see anything checking that TCP_METRICS_ATTR_SADDR_IPV4
  is at least 4 bytes long, and the policy doesn't have an entry
  …
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  tcp_metrics: validate source addr length

  I don't see anything checking that TCP_METRICS_ATTR_SADDR_IPV4
  is at least 4 bytes long, and the policy doesn't have an entry
  …
severity: medium
cvss: 4.4
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N'
cwe:
  - CWE-754
vendor: linux
product: linux_kernel
affected:
  - 'linux_kernel >= 3.14, < 4.19.318'
  - 'linux_kernel >= 4.20, < 5.4.280'
  - 'linux_kernel >= 5.5, < 5.10.222'
  - 'linux_kernel >= 5.11, < 5.15.163'
  - 'linux_kernel >= 5.16, < 6.1.98'
  - 'linux_kernel >= 6.2, < 6.6.39'
  - 'linux_kernel >= 6.7, < 6.9.9'
  - linux_kernel = 6.10
patched:
  - linux_kernel 6.9.9
published: '2024-07-30'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T01:18:44.380'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2024-42154'
references:
  - url: 'https://git.kernel.org/stable/c/19d997b59fa1fd7a02e770ee0881c0652b9c32c9'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/2a2e79dbe2236a1289412d2044994f7ab419b44c'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/31f03bb04146c1c6df6c03e9f45401f5f5a985d3'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/3d550dd5418729a6e77fe7721d27adea7152e321'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/66be40e622e177316ae81717aa30057ba9e61dff'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/8c2debdd170e395934ac0e039748576dfde14e99'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/cdffc358717e436bb67122bb82c1a2a26e050f98'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/ef7c428b425beeb52b894e16f1c4b629d6cebfb6'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'http://www.openwall.com/lists/oss-security/2024/09/24/3'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://www.openwall.com/lists/oss-security/2024/09/24/4'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://www.openwall.com/lists/oss-security/2024/09/25/3'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://git.kernel.org/stable/c/19d997b59fa1fd7a02e770ee0881c0652b9c32c9'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://git.kernel.org/stable/c/2a2e79dbe2236a1289412d2044994f7ab419b44c'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://git.kernel.org/stable/c/31f03bb04146c1c6df6c03e9f45401f5f5a985d3'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://git.kernel.org/stable/c/3d550dd5418729a6e77fe7721d27adea7152e321'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://git.kernel.org/stable/c/66be40e622e177316ae81717aa30057ba9e61dff'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://git.kernel.org/stable/c/8c2debdd170e395934ac0e039748576dfde14e99'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://git.kernel.org/stable/c/cdffc358717e436bb67122bb82c1a2a26e050f98'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://git.kernel.org/stable/c/ef7c428b425beeb52b894e16f1c4b629d6cebfb6'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://security.netapp.com/advisory/ntap-20240828-0010/'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-355557.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-398330.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-503939.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-613116.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
tags:
  - nvd
  - cve.org
epss: 0.00258
epssPercentile: 0.16245
ingestedAt: '2026-10-15T03:30:12.730Z'
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2024-09-10T16:15:15.159948Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

tcp_metrics: validate source addr length

I don't see anything checking that TCP_METRICS_ATTR_SADDR_IPV4
is at least 4 bytes long, and the policy doesn't have an entry
for this attribute at all (neither does it for IPv6 but v6 is
manually validated).

## Affected

- `linux_kernel >= 3.14, < 4.19.318`
- `linux_kernel >= 4.20, < 5.4.280`
- `linux_kernel >= 5.5, < 5.10.222`
- `linux_kernel >= 5.11, < 5.15.163`
- `linux_kernel >= 5.16, < 6.1.98`
- `linux_kernel >= 6.2, < 6.6.39`
- `linux_kernel >= 6.7, < 6.9.9`
- `linux_kernel = 6.10`

## Remediation

Upgrade past the affected range:

- `linux_kernel 6.9.9`