CVE-2024-35975

What it actually does

The octeontx2-pf network driver fails to release allocated transmit scheduler resources upon network class deletion due to a bug introduced in round-robin scheduling support, causing a persistent resource leak.

Why it matters to the business

Linux systems using the affected driver may experience gradual exhaustion of transmit scheduler resources in environments with frequent class creation and deletion, leading to degraded network performance, increased operational overhead, and potential service disruptions requiring system restarts.

How an attack unfolds

An attacker with sufficient privileges to manage network traffic classes repeatedly creates and deletes classes through the netdev interface, triggering the leak without freeing schedulers and eventually depleting available resources on vulnerable kernels.

How to fix it

Update the Linux kernel to a version containing commit 7af5582ea67209a23e44be9a9612ba7897be1f47 which ensures transmit schedulers are freed on class deletion; apply the fix from stable kernel branches as appropriate for the distribution.

How to confirm the fix worked

Confirm the presence of the fix by inspecting kernel source for the scheduler free logic after class deletion; test by creating and deleting multiple classes while monitoring scheduler resource counters to verify no leaks occur.

Typical attack path

1. Identify systems running vulnerable Linux kernel versions with the octeontx2-pf driver enabled
2. Obtain privileges required to create and delete network classes
3. Perform repeated class creation and deletion operations via netdev or tc commands
4. Observe progressive depletion of transmit scheduler resources leading to denial of service conditions

How to detect it

Examine kernel logs and dmesg output for allocation warnings or failures related to transmit schedulers; track long-term trends in networking resource utilization metrics on systems with dynamic class management.

What your security team should do

• Apply kernel updates containing the referenced commit to all affected systems as the primary remediation
• Audit network configurations for unnecessary class creation/deletion activity
• Implement monitoring for scheduler resource usage anomalies in production environments