CVE-2024-43835

What it actually does

virtio_net incorrectly assumes NAPI context in virtnet_poll_tx() and virtnet_poll_cleantx() even during non-NAPI scenarios such as netpoll, triggering napi_skb_cache_put warnings and invalid operations.

Why it matters to the business

Networking instability and log spam in virtualized Linux environments with 7,079 downstream dependents; low urgency given false KEV status, 0.0025 EPSS with flat trend, and 786 days since publication.

How an attack unfolds

An attacker triggers netpoll paths (for example via crafted traffic or console access) to force virtio_net outside NAPI context, surfacing the warning; listed threat actors reference generic Linux kernel campaigns but no specific exploitation of this issue is indicated.

How to fix it

Upgrade Linux kernel to commit d3af435e8ace119e58d8e21d3d2d6a4e7c4a4baa or later; note that listed urllib3 1.26.5 fixes are unrelated and should be ignored for this kernel issue.

How to confirm the fix worked

Confirm kernel contains the referenced commit, reproduce netpoll workloads, and verify absence of the napi_skb_cache_put warning in dmesg.

Typical attack path

1. Identify Linux guest using virtio_net under netpoll conditions
2. Send traffic or trigger events that invoke __free_old_xmit outside NAPI
3. Observe napi_skb_cache_put warning and potential follow-on issues

How to detect it

Search kernel logs for the exact warning string and stack trace involving napi_skb_cache_put and __free_old_xmit; correlate with virtio_net activity during netpoll events.

• WARNING: CPU:.*napi_skb_cache_put+0x82/0x4b0
• __free_old_xmit+0x1c8/0x510
• virtnet_poll_tx
• virtnet_poll_cleantx

What your security team should do

• Apply the kernel fix to all affected virtio_net deployments
• Monitor dmesg for napi_skb_cache_put warnings as a temporary detection measure
• Review virtualization and netpoll configurations for exposure