CVE-2024-41036

What it actually does

The vulnerability causes a deadlock in the ks8851 SPI Ethernet driver when SMP is enabled, due to improper use of spinlocks in TX transmission and IRQ handling paths, leading to soft lockups.

Why it matters to the business

Systems using the affected Linux kernel with ks8851 SPI network chips may experience network interface hangs and system instability, disrupting operations on embedded or specific hardware setups. With low EPSS and no KEV status, immediate widespread risk is low but patching is advised for affected kernels.

How an attack unfolds

An attacker with the ability to trigger network transmissions or interrupts on a system with the vulnerable ks8851 driver can cause a race condition leading to deadlock. Threat actors in espionage and financial campaigns have targeted similar Linux kernel issues, though this specific flaw's exploitation is not confirmed.

How to fix it

Update the Linux kernel to version 6.1.100 or apply the commit a0c69c492f4a8fad52f0a97565241c926160c9a4 in the stable git repository. Use spin_(un)lock_bh for TX queue locking as per the fix.

How to confirm the fix worked

Verify kernel version is at least 6.1.100 and check for the presence of the fix commit in the source. Test network functionality under SMP conditions without lockups.

Typical attack path

1. Identify system with ks8851 SPI driver
2. Trigger concurrent TX and IRQ events
3. Cause spinlock contention leading to deadlock
4. Induce soft lockup and system unresponsiveness

How to detect it

Look for watchdog soft lockup messages mentioning ks8851_start_xmit_spi or queued_spin_lock_slowpath in kernel logs. Check for prolonged CPU stalls in network transmit paths.

What your security team should do

• Prioritize kernel updates on systems using ks8851 driver
• Monitor for soft lockup messages in logs
• Disable SMP if patching not possible as temporary mitigation (though not recommended)