CVE-2024-26820

What it actually does

Race condition in hv_netvsc prevents successful VF registration when the driver is unloaded and reloaded because the netdevice notifier is registered before vmbus_driver_register completes, leaving matching VFs unregistered if the NET_DEVICE_REGISTER event arrives too early.

Why it matters to the business

Linux systems using Hyper-V networking may experience incomplete virtual function attachment after driver reloads, causing network connectivity loss or degraded performance until manual intervention or reboot.

How an attack unfolds

An attacker with local privileges unloads and reloads the hv_netvsc driver at a precise timing that triggers the early notifier registration race, resulting in one or more VFs remaining unregistered and unavailable for network use.

How to fix it

Upgrade the Linux kernel to a fixed version such as 4.19.310 or apply the commit bcb7164258d0a9a8aa2e73ddccc2d78f67d2519d (or equivalent backports) in the hv_netvsc driver to register VFs at the end of netvsc_probe.

How to confirm the fix worked

After patching, unload and reload hv_netvsc while ensuring all expected VFs appear as netdevices; confirm that netvsc_probe now registers matching VFs and that network interfaces function without manual re-registration.

Typical attack path

1. Obtain local user access on a Linux system running hv_netvsc
2. Unload the hv_netvsc kernel module
3. Reload the hv_netvsc kernel module before all matching VFs have appeared as netdevices
4. Trigger or wait for NET_DEVICE_REGISTER events that arrive before netvsc_probe finishes
5. Observe that VF registration fails, leaving network interfaces non-functional

How to detect it

Review kernel logs around hv_netvsc module load events for missing VF registration messages; correlate with netdevice registration timestamps that precede netvsc_probe completion; inspect dmesg or journalctl for race-related warnings after driver reloads.

What your security team should do

• Prioritize kernel upgrades on all Hyper-V Linux guests to the versions listed in the fixed_versions
• Monitor for driver reload events in production workloads that rely on VF networking
• Test the unload/reload sequence in a lab environment matching production kernel versions before broad deployment