CVE-2024-44995

What it actually does

Race condition in the hns3 network driver allows a deadlock when TC configuration and device reset overlap, because napi_disable/enable and netif_napi_del/add sequences are not properly serialized, leaving the port in an inconsistent UP state before UINIT completes.

Why it matters to the business

On affected Linux systems using hns3 hardware, network configuration changes during reset can cause the system to hang, disrupting connectivity and requiring a reboot; widespread in data-center and cloud environments that rely on this driver.

How an attack unfolds

An attacker with local privileges triggers a device reset while simultaneously issuing TC configuration commands; the mismatched napi state transitions between the reset path and the setup-TC path acquire locks in opposite orders, resulting in deadlock.

How to fix it

Update the Linux kernel to the commit 67492d4d105c0a6321b00c393eec96b9a7a97a16 or a later stable release that adds a DOWN step inside UINIT; apply vendor backports for the running distribution kernel.

How to confirm the fix worked

Confirm the presence of commit 67492d4d105c0a6321b00c393eec96b9a7a97a16 in the running kernel source; verify that TC configuration during simulated reset no longer produces deadlock; check dmesg for absence of the original deadlock symptoms.

Typical attack path

1. Obtain local access or execute privileged network configuration commands
2. Initiate a PF or global reset on the hns3 device
3. Concurrently run TC setup operations that call napi_disable and napi_enable
4. Trigger the window where UINIT performs netif_napi_del without a preceding DOWN, causing deadlock

How to detect it

Search kernel logs and dmesg for repeated hns3 reset sequences interleaved with TC configuration; look for hung task warnings or lockdep reports involving napi_disable and netif_napi_del during device reinitialization.

What your security team should do

• Prioritize kernel updates on all systems exposing hns3 interfaces within the next maintenance window
• Restrict unprivileged TC configuration and reset operations via capabilities or SELinux policies until patched
• Monitor for kernel deadlocks on hns3 devices and schedule staged rollouts for high-availability clusters