cbcvebase.
CVE-2024-26859
published 2024-04-17

CVE-2024-26859: In the Linux kernel, the following vulnerability has been resolved: net/bnx2x: Prevent access to a freed page in page_pool Fix race condition leading to system…

PriorityP417medium4.7CVSS 3.1
AVLACHPRLUINSUCNINAH
EPSS
0.18%
8.0th percentile
In the Linux kernel, the following vulnerability has been resolved: net/bnx2x: Prevent access to a freed page in page_pool Fix race condition leading to system crash during EEH error handling During EEH error recovery, the bnx2x driver's transmit timeout logic could cause a race condition when handling reset tasks. The bnx2x_tx_timeout() schedules reset tasks via bnx2x_sp_rtnl_task(), which ultimately leads to bnx2x_nic_unload(). In bnx2x_nic_unload() SGEs are freed using bnx2x_free_rx_sge_range(). However, this could overlap with the EEH driver's attempt to reset the device using bnx2x_io_slot_reset(), which also tries to free SGEs. This race condition can result in system crashes due to accessing freed memory locations in bnx2x_free_rx_sge() 799 static inline void bnx2x_free_rx_sge(struct bnx2x *bp, 800 struct bnx2x_fastpath *fp, u16 index) 801 { 802 struct sw_rx_page *sw_buf = &fp->rx_page_ring[index]; 803 struct page *page = sw_buf->page; .... where sw_buf was set to NULL after the call to dma_unmap_page() by the preceding thread. EEH: Beginning: 'slot_reset' PCI 0011:01:00.0#10000: EEH: Invoking bnx2x->slot_reset() bnx2x: [bnx2x_io_slot_reset:14228(eth1)]IO slot reset initializing... bnx2x 0011:01:00.0: enabling device (0140 -> 0142) bnx2x: [bnx2x_io_slot_reset:14244(eth1)]IO slot reset --> driver unload Kernel attempted to read user page (0) - exploit attempt? (uid: 0) BUG: Kernel NULL pointer dereference on read at 0x00000000 Faulting instruction address: 0xc0080000025065fc Oops: Kernel access of bad area, sig: 11 [#1] ..... Call Trace: [c000000003c67a20] [c00800000250658c] bnx2x_io_slot_reset+0x204/0x610 [bnx2x] (unreliable) [c000000003c67af0] [c0000000000518a8] eeh_report_reset+0xb8/0xf0 [c000000003c67b60] [c000000000052130] eeh_pe_report+0x180/0x550 [c000000003c67c70] [c00000000005318c] eeh_handle_normal_event+0x84c/0xa60 [c000000003c67d50] [c000000000053a84] eeh_event_handler+0xf4/0x170 [c000000003c67da0] [c000000000194c58] kthread+0x1c8/0x1d0 [c0000

Affected

27 ranges· showing 25
VendorProductVersion rangeFixed in
debiandebian_linux
debianlinux< linux 6.1.85-1 (bookworm)linux 6.1.85-1 (bookworm)
linuxlinux
linuxlinux>= 4cace675d687ebd2d813e90af80ff87ee85202f9 < 7bcc090c81116c66936a7415f2c6b1483a4bcfd97bcc090c81116c66936a7415f2c6b1483a4bcfd9
linuxlinux>= 4cace675d687ebd2d813e90af80ff87ee85202f9 < 4f37d3a7e004bbf560c21441ca9c022168017ec44f37d3a7e004bbf560c21441ca9c022168017ec4
linuxlinux>= 4cace675d687ebd2d813e90af80ff87ee85202f9 < 8eebff95ce9558be66a36aa7cfb43223f3ab46998eebff95ce9558be66a36aa7cfb43223f3ab4699
linuxlinux>= 4cace675d687ebd2d813e90af80ff87ee85202f9 < 8ffcd3ccdbda0c918c4a0f922ef1c17010f1b5988ffcd3ccdbda0c918c4a0f922ef1c17010f1b598
linuxlinux>= 4cace675d687ebd2d813e90af80ff87ee85202f9 < cf7d8cba639ae792a42c2a137b495eac262ac36ccf7d8cba639ae792a42c2a137b495eac262ac36c
linuxlinux>= 4cace675d687ebd2d813e90af80ff87ee85202f9 < 3a9f78b297e08ca8e88ae3ecff1f6fe2766dc5eb3a9f78b297e08ca8e88ae3ecff1f6fe2766dc5eb
linuxlinux>= 4cace675d687ebd2d813e90af80ff87ee85202f9 < c51f8b6930db3f259b8820b589f2459d2df3fc68c51f8b6930db3f259b8820b589f2459d2df3fc68
linuxlinux>= 4cace675d687ebd2d813e90af80ff87ee85202f9 < 44f9f1abb0ecc43023225ab9539167facbabf0ec44f9f1abb0ecc43023225ab9539167facbabf0ec
linuxlinux>= 4cace675d687ebd2d813e90af80ff87ee85202f9 < d27e2da94a42655861ca4baea30c8cd65546f25dd27e2da94a42655861ca4baea30c8cd65546f25d
linuxlinux_kernel>= 0 < 5.10.216-15.10.216-1
linuxlinux_kernel>= 0 < 6.1.85-16.1.85-1
linuxlinux_kernel>= 0 < 6.7.12-16.7.12-1
linuxlinux_kernel>= 0 < 6.7.12-16.7.12-1
linuxlinux_kernel>= 0 < 5.4.0-189.2095.4.0-189.209
linuxlinux_kernel>= 0 < 5.15.0-112.1225.15.0-112.122
linuxlinux_kernel>= 0 < 6.8.0-35.356.8.0-35.35
linuxlinux_kernel>= 4.2 < 4.19.3114.19.311
linuxlinux_kernel>= 4.20 < 5.4.2735.4.273
linuxlinux_kernel>= 5.11 < 5.15.1535.15.153
linuxlinux_kernel>= 5.16 < 6.1.836.1.83
linuxlinux_kernel>= 5.5 < 5.10.2145.10.214
linuxlinux_kernel>= 6.2 < 6.6.236.6.23

CVSS provenance

nvdv3.14.7MEDIUMCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
osv7.0HIGH
vendor_ubuntu7.0HIGH
vendor_debian4.7MEDIUM
vendor_redhat4.7MEDIUM
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.