CVE-2024-43862

What it actually does

Holding a spinlock while calling a function that acquires a mutex creates an invalid wait context that can deadlock the kernel during carrier detection operations in the fsl_qmc_hdlc driver.

Why it matters to the business

Networking interfaces on affected Linux systems may hang or cause kernel deadlocks under normal carrier status checks, leading to service disruption and requiring reboots.

How an attack unfolds

An attacker or routine network configuration activity triggers carrier status queries while the rtnl_mutex is held; the spinlock acquisition followed by a mutex-taking call inside framer_get_status produces the deadlock without any special privileges beyond local network interface interaction.

How to fix it

Upgrade the Linux kernel to version 6.10.4 or later, or apply commit f223d2b4acb7a45a6e0581cb380e1af1a6dc7ab9 that converts carrier_lock from a spinlock to a mutex.

How to confirm the fix worked

Verify the running kernel version is at least 6.10.4; confirm the presence of the mutex conversion in the fsl_qmc_hdlc source and test that PROVE_LOCKING no longer reports invalid wait context on carrier operations.

Typical attack path

1. Obtain local access or trigger network interface configuration commands such as ifconfig
2. Acquire rtnl_mutex during devinet_ioctl
3. Acquire carrier_lock spinlock in qmc_hdlc_framer_set_carrier
4. Call framer_get_status which attempts to acquire a mutex while the spinlock is held
5. Trigger BUG invalid wait context and deadlock

How to detect it

Search kernel logs for BUG: Invalid wait context messages referencing framer->mutex and carrier_lock; inspect stack traces containing qmc_hdlc_framer_set_carrier and framer_get_status; review dmesg or syslog for deadlock indicators after network interface events.

• BUG: Invalid wait context
• c204ddbc (&framer->mutex){+.+.}-{3:3}, at: framer_get_status+0x40/0x78
• qmc_hdlc_framer_set_carrier
• context-{4:4}
• carrier_lock

What your security team should do

• Patch all Linux systems to kernel 6.10.4 or the backported fix immediately
• Prioritize systems exposing WAN interfaces using the fsl_qmc_hdlc driver
• Monitor for kernel BUG reports containing invalid wait context or carrier_lock references