CVE-2024-26698

What it actually does

Race condition between netvsc_probe and netvsc_remove in hv_netvsc driver causes napi_disable to hang indefinitely on subchannels whose NAPI structs were registered but never enabled because subchan_work had not yet run.

Why it matters to the business

Linux systems using Hyper-V networking can experience kernel-level hangs requiring reboots, resulting in unplanned downtime for virtualized workloads and potential loss of network connectivity.

How an attack unfolds

An attacker with local access triggers concurrent or rapid probe and remove sequences via module load/unload or VMBus hotplug events; when netvsc_remove calls napi_disable on a subchannel whose netif_napi_add has set NAPI_STATE_SCHED but netvsc_sc_open has not cleared it, the call blocks forever on msleep.

How to fix it

Upgrade the Linux kernel to a version containing commit 9ec807e7b6f5fcf9499f3baa69f254bb239a847f; ensure netif_napi_del is still performed for cleanup while skipping napi_disable on non-enabled NAPIs.

How to confirm the fix worked

Confirm commit 9ec807e7b6f5fcf9499f3baa69f254bb239a847f is present in the kernel tree, then exercise repeated netvsc_probe/netvsc_remove cycles and verify no tasks remain stuck in napi_disable.

Typical attack path

1. Load hv_netvsc module or attach VMBus device to invoke netvsc_probe
2. Trigger netvsc_remove before subchan_work and rndis_set_subchannel complete
3. Execute netvsc_device_remove which walks uninitialized subchannels
4. Invoke napi_disable on NAPI structs that never had napi_enable called
5. Observe indefinite schedule_timeout inside msleep

How to detect it

Search kernel logs and task dumps for processes blocked in napi_disable called from netvsc_device_remove or rndis_filter_device_remove with stack frames containing hv_netvsc and msleep.

• napi_disable+0x2b/0x80
• netvsc_device_remove+0x8a/0x1f0 [hv_netvsc]
• msleep+0x2d/0x40
• schedule_timeout+0x87/0x140
• netvsc_remove+0x7c/0x120 [hv_netvsc]

What your security team should do

• Apply the referenced kernel commit to all Hyper-V Linux guests without delay
• Restrict unprivileged module loading and VMBus device attach rights
• Add kernel oops and task-hang alerts for hv_netvsc symbols to monitoring