CVE-2024-26830

What it actually does

The vulnerability in the i40e driver allows an untrusted VF to remove a primary MAC address that was administratively set by the PF, causing the MAC filter to be cleared and the primary VF MAC to be zeroed when the VF interface is brought down.

Why it matters to the business

In SR-IOV virtualization environments, this can cause unexpected loss of network connectivity for virtual functions, leading to service interruptions, increased operational overhead for manual MAC re-assignment, and potential availability issues for dependent workloads.

How an attack unfolds

An attacker controlling an untrusted VF first ensures the interface is up, waits for or triggers administrative MAC assignment by the PF, then brings the VF interface down; the driver incorrectly permits deletion of the administratively set primary MAC, resulting in the VF losing its configured address.

How to fix it

Update the Linux kernel to a version containing commit 1c981792e4ccbc134b468797acdd7781959e6893 or later stable releases that include the i40e MAC filter protection; apply vendor-supplied kernel packages that backport the fix.

How to confirm the fix worked

Verify the presence of the fix by checking kernel source or git history for commit 1c981792e4ccbc134b468797acdd7781959e6893; reproduce the original scenario and confirm the administratively set MAC persists after the VF is brought down.

Typical attack path

1. Create a VF via SR-IOV configuration
2. Bring the VF interface up
3. Have the PF administratively set the VF MAC address
4. Bring the VF interface down
5. Observe the primary MAC being zeroed and removed from filters

How to detect it

Review kernel logs for i40e driver messages related to VF MAC filter modifications or primary MAC resets during VF interface state changes; correlate with SR-IOV configuration events in system logs.

What your security team should do

• Prioritize kernel updates on systems using i40e SR-IOV virtualization
• Restrict untrusted VF usage or enable trust mode only for verified workloads
• Monitor kernel changelogs for i40e driver updates in future releases