CVE-2024-39506

What it actually does

Potential null pointer dereference in lio_vf_rep_copy_packet() when pg_info->page is NULL yet unconditionally passed to skb_add_rx_frag() during VF rep packet receive processing in the liquidio driver.

Why it matters to the business

May cause kernel crashes or denial of service on systems using LiquidIO/Octeon network adapters, leading to downtime for network-intensive workloads; low exploitability and dated publication reduce immediate urgency despite kernel memory corruption classification.

How an attack unfolds

An attacker sends crafted network traffic that reaches octeon_droq_process_packets through the VF rep dispatch path, triggering the unconditioned skb_add_rx_frag call with a NULL page pointer and inducing a dereference crash; no known public exploits or specific threat actor campaigns target this issue.

How to fix it

Upgrade the Linux kernel to a version containing commit 87d6bdc006f0cbf297a3b2ad6e40ede4c3ee5dc2 or later; rebuild and deploy the fixed kernel image, then reboot affected hosts.

How to confirm the fix worked

Verify the presence of commit 87d6bdc006f0cbf297a3b2ad6e40ede4c3ee5dc2 in the kernel source tree or confirm the running kernel version includes the corrected lio_vf_rep_copy_packet logic; test with synthetic packet receive workloads on LiquidIO hardware.

Typical attack path

1. Attacker gains network access to a system with LiquidIO VF representation enabled.
2. Crafted packets enter octeon_droq_fast_process_packets and reach lio_vf_rep_pkt_recv.
3. lio_vf_rep_copy_packet evaluates pg_info->page against NULL but still invokes skb_add_rx_frag unconditionally.
4. Kernel dereferences the NULL pointer, resulting in panic or oops during receive processing.

How to detect it

Search kernel logs and crash dumps for oops traces involving liquidio, octeon_droq_process_packets, or lio_vf_rep_copy_packet; correlate with network receive activity on Cavium/Octeon interfaces.

What your security team should do

• Apply the fixed kernel commit 87d6bdc006f0cbf297a3b2ad6e40ede4c3ee5dc2 to all affected distributions.
• Prioritize patching systems with LiquidIO or Octeon adapters in production network paths.
• Monitor for kernel oops or panic logs referencing liquidio or skb_add_rx_frag after deployment.
• Review downstream dependent packages and rebuild any custom kernels incorporating the liquidio driver.