CVE-2024-50018

What it actually does

The flaw permits signed integer overflow of napi_defer_hard_irqs when a value exceeding S32_MAX is written via sysfs, wrapping the count to a large negative number and altering NAPI hard-IRQ deferral logic.

Why it matters to the business

Network devices may silently enter unexpected interrupt-handling states, degrading performance or stability under load; the Linux kernel's broad ecosystem prevalence means many distributions and downstream systems remain exposed until upgraded.

How an attack unfolds

An attacker with root privileges identifies a network interface and writes an oversized integer to its napi_defer_hard_irqs sysfs entry, causing the signed value to overflow and produce a negative deferral count that changes NAPI scheduling behavior.

How to fix it

Upgrade the Linux kernel to version 6.11.4-1 or later; the fix changes napi_defer_irqs and napi_defer_irqs_count to u32 and adds a sysfs overflow check that rejects values above S32_MAX.

How to confirm the fix worked

Confirm the running kernel is at least 6.11.4-1, then attempt to echo a value larger than 2147483647 into any napi_defer_hard_irqs sysfs file and verify the write is rejected with "Numerical result out of range".

Typical attack path

1. Obtain root or CAP_NET_ADMIN privileges on a Linux host
2. Locate the target network interface under /sys/class/net
3. Write a value greater than S32_MAX to napi_defer_hard_irqs
4. Observe resulting negative count and altered interrupt deferral

How to detect it

Search kernel and audit logs for writes to /sys/class/net/*/napi_defer_hard_irqs; inspect network device statistics for negative napi_defer_irqs_count values; review any "Numerical result out of range" errors from sysfs writes.

• /sys/class/net/*/napi_defer_hard_irqs
• echo.*napi_defer_hard_irqs
• Numerical result out of range
• napi_defer_irqs_count

What your security team should do

• Prioritize kernel upgrades to 6.11.4-1 across all affected systems
• Audit existing napi_defer_hard_irqs settings for any unexpectedly large or negative values
• Restrict write access to network sysfs entries via mandatory access controls