CVE-2024-35958

What it actually does

Incorrect descriptor freeing in ena_free_tx_bufs() uses napi_consume_skb() on XDP-specific TX queues, causing improper unmapping and freeing of descriptors during VF reset and resulting in kernel crashes.

Why it matters to the business

Linux systems using ENA network adapters in virtualized or XDP environments may experience unexpected crashes and downtime, particularly during network interface resets; high prevalence in cloud and container workloads increases operational risk.

How an attack unfolds

An attacker with local access triggers a VF reset on an affected ENA queue handling XDP traffic; the flawed freeing logic then mishandles descriptors, leading to a crash. No widespread remote exploitation or named threat actors are associated with this issue.

How to fix it

Update the Linux kernel to a version containing commit b26aa765f7437e1bbe8db4c1641b12bd5dd378f0 or later stable releases that incorporate the ENA driver fix; rebuild and reboot with the patched kernel.

How to confirm the fix worked

Verify the running kernel includes commit b26aa765f7437e1bbe8db4c1641b12bd5dd378f0 via git log or kernel version; test VF reset scenarios with XDP traffic to confirm no crashes occur.

Typical attack path

1. Obtain local access to a system using ENA with XDP-enabled queues
2. Cause or wait for a VF reset event on the affected TX queue
3. Trigger the incorrect descriptor free path resulting in kernel panic

How to detect it

Review kernel crash logs and dmesg for ENA TX queue descriptor errors around the time of VF resets; correlate with XDP redirect activity in system logs.

What your security team should do

• Prioritize kernel updates on systems using ENA adapters with XDP
• Monitor for kernel panics related to ena driver during network resets
• Apply the fix in development and staging environments first before production rollout