CVE-2024-44984

What it actually does

Double DMA unmap call remains in bnxt_en XDP_REDIRECT path after page pool assumed mapping responsibility, triggering iommu_dma_unmap_page warnings and potential memory management corruption on affected IOMMU systems.

Why it matters to the business

Network-intensive systems using Broadcom bnxt_en adapters with XDP may encounter repeated kernel warnings, degraded performance, or instability during packet processing, increasing operational risk in high-throughput environments.

How an attack unfolds

An attacker sends traffic that activates the XDP_REDIRECT code path in the bnxt_en driver; the leftover dma_unmap_page_attrs call executes after the page pool mapping, producing IOMMU warnings and possible corruption without requiring authentication.

How to fix it

Upgrade the Linux kernel to a version containing commit fa4e6ae38574d0fc5596272bee64727d8ab7052b or later stable releases that remove the erroneous dma_unmap_page_attrs call in the XDP_REDIRECT path.

How to confirm the fix worked

Verify the running kernel contains the referenced commit or is newer than the affected series; confirm absence of the iommu_dma_unmap_page warning during XDP_REDIRECT workloads on bnxt_en interfaces.

Typical attack path

1. Attacker delivers packets or deploys an XDP program that triggers bnxt_rx_xdp
2. Driver enters bnxt_rx_pkt and calls into the XDP redirect handler
3. dma_unmap_page_attrs executes on an already unmapped page-pool buffer
4. iommu_dma_unmap_page logs warning and may leave IOMMU mappings inconsistent

How to detect it

Search kernel logs and dmesg for the exact warning string from iommu_dma_unmap_page, entries referencing bnxt_rx_xdp or bnxt_en, and ksoftirqd processes during high network activity.

• WARNING: CPU: .* at drivers/iommu/dma-iommu.c:1198 iommu_dma_unmap_page
• bnxt_rx_xdp.*[bnxt_en]
• dma_unmap_page_attrs+0x55/0x220
• ksoftirqd.*Tainted: G W

What your security team should do

• Apply the fixed kernel version immediately on systems exposing bnxt_en interfaces to XDP traffic
• Monitor dmesg and kernel logs for iommu_dma_unmap_page warnings as an interim detection measure
• Disable XDP_REDIRECT on affected adapters until patches are deployed if workload permits