CVE-2024-27046

What it actually does

Null pointer dereference in nfp_fl_lag_do_work() when kmalloc_array() for acti_netdevs fails under memory pressure, causing kernel instability or crash upon dereference.

Why it matters to the business

Unexpected system crashes or service interruptions on Linux hosts using nfp flower networking under memory-constrained conditions, leading to downtime and operational recovery efforts.

How an attack unfolds

An attacker induces memory exhaustion on the target system to force allocation failure inside nfp_fl_lag_do_work(), then triggers the code path that dereferences the uninitialized pointer, resulting in a kernel panic. No named threat actors or ransomware campaigns are associated with this issue.

How to fix it

Upgrade the Linux kernel to a version containing commit d746889db75a76aeee95fb705b8e1ac28c684a2e or later, which adds an allocation-failure check and reschedules the work item.

How to confirm the fix worked

Confirm presence of the allocation-success check and error handling path in nfp_fl_lag_do_work() within the running kernel source or by inspecting the fixed commit; test under simulated memory pressure to ensure no null dereference occurs.

Typical attack path

1. Exhaust physical memory on the target host
2. Trigger nfp flower LAG delayed work execution
3. Force null allocation of acti_netdevs array
4. Dereference the null pointer to induce kernel panic

How to detect it

Review kernel ring buffer and syslog for oops or panic traces referencing nfp_fl_lag_do_work and acti_netdevs; correlate with memory-pressure events or nfp flower LAG activity.

What your security team should do

• Apply the referenced kernel commit or distribution update containing the fix
• Monitor kernel logs for nfp-related allocation warnings during memory pressure events
• Prioritize updates on systems running nfp flower networking with LAG configurations