CVE-2024-41005

MEDIUM

Linux Kernel - Race Condition in netpoll_owner_active

Title source: llm
STIX 2.1

Description

In the Linux kernel, the following vulnerability has been resolved: netpoll: Fix race condition in netpoll_owner_active KCSAN detected a race condition in netpoll: BUG: KCSAN: data-race in net_rx_action / netpoll_send_skb write (marked) to 0xffff8881164168b0 of 4 bytes by interrupt on cpu 10: net_rx_action (./include/linux/netpoll.h:90 net/core/dev.c:6712 net/core/dev.c:6822) <snip> read to 0xffff8881164168b0 of 4 bytes by task 1 on cpu 2: netpoll_send_skb (net/core/netpoll.c:319 net/core/netpoll.c:345 net/core/netpoll.c:393) netpoll_send_udp (net/core/netpoll.c:?) <snip> value changed: 0x0000000a -> 0xffffffff This happens because netpoll_owner_active() needs to check if the current CPU is the owner of the lock, touching napi->poll_owner non atomically. The ->poll_owner field contains the current CPU holding the lock. Use an atomic read to check if the poll owner is the current CPU.

Scores

CVSS v3 4.7
EPSS 0.0019
EPSS Percentile 8.8%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-362
Status published
Products (20)
linux/Kernel 4.10.0 - 5.10.221linux
linux/Kernel 5.11.0 - 5.15.162linux
linux/Kernel 5.16.0 - 6.1.96linux
linux/Kernel 6.2.0 - 6.6.36linux
linux/Kernel 6.7.0 - 6.9.7linux
Linux/Linux < 4.10
Linux/Linux 4.10
Linux/Linux 5.10.221 - 5.10.*
Linux/Linux 5.15.162 - 5.15.*
Linux/Linux 6.1.96 - 6.1.*
... and 10 more
Published Jul 12, 2024
Tracked Since Feb 18, 2026