CVE-2024-43872

What it actually does

Interrupt-context handling of completion event queue entries (CEQEs) under heavy load allows a single CPU core to remain in interrupt context indefinitely, triggering soft lockups.

Why it matters to the business

Systems may experience sudden freezes or reboots during high RDMA traffic, disrupting storage, networking, or high-performance computing workloads and requiring manual intervention or restarts.

How an attack unfolds

An attacker generates sustained high volumes of RDMA completion events targeting the hns driver, forcing the interrupt handler to process more CEQEs than the kernel watchdog tolerates and inducing a soft lockup.

How to fix it

Update the Linux kernel to commit 06580b33c183c9f98e2a2ca96a86137179032c08 or later; for affected Qualcomm Android platforms update to SoCVersion 2021-02-05 or newer. Where immediate patching is impossible, limit RDMA traffic or disable the hns driver.

How to confirm the fix worked

Confirm the running kernel contains commit 06580b33c183c9f98e2a2ca96a86137179032c08, verify CEQEs are now processed in a BH workqueue with a bounded per-invocation limit, and monitor for absence of soft-lockup messages under synthetic load tests.

Typical attack path

1. Identify a target system using the hns RDMA driver under Linux kernel or affected Qualcomm Android WLAN stacks.
2. Establish RDMA connections and flood the device with operations that produce large numbers of CEQEs.
3. Maintain the event rate long enough to exceed the soft-lockup threshold in the interrupt handler.
4. Observe system freeze or forced reboot confirming denial of service.

How to detect it

Search kernel logs for repeated soft-lockup or watchdog messages mentioning hns or CEQE; correlate with spikes in RDMA completion interrupts. No public exploitation artifacts are known.

What your security team should do

• Apply the listed kernel or SoC fixes within standard change windows given low EPSS and no KEV listing.
• Add soft-lockup and hns driver watchdog alerts to existing kernel monitoring.
• Test RDMA workloads after upgrade to ensure performance is unaffected.
• Review downstream Android device images for the 2021-02-05 SoCVersion update.