CVE-2024-50041

What it actually does

Race condition in the i40e Linux kernel driver allows concurrent modification of vsi->mac_filter_hash without proper locking, resulting in inconsistent state and memory leaks when i40e_del_mac_filter and related VF address operations execute simultaneously.

Why it matters to the business

Systems using affected Intel Ethernet adapters may experience gradual memory exhaustion on network interfaces configured with VFs and port VLANs, increasing operational overhead and potential service degradation in high-throughput environments until patched kernels are deployed.

How an attack unfolds

An attacker with local access spawns virtual functions, configures port VLANs, and triggers concurrent add/delete operations on MAC and VLAN filters to induce the unsynchronized hash table access and leak; while listed in broader Linux kernel exploitation campaigns by espionage and financially motivated actors, this specific issue requires privileged local conditions rather than remote unauthenticated exploitation.

How to fix it

Update the Linux kernel to the commit 3d7cb6b04c3f3115719235cc6866b10326de34cd or later versions that synchronize mac_filter_hash access with spin_lock_bh/unlock_bh around i40e_del_mac_filter and default LAN address zeroing, and include the lockdep assertion in i40e_add_mac_filter.

How to confirm the fix worked

Confirm the running kernel contains commit 3d7cb6b04c3f3115719235cc6866b10326de34cd; reproduce the original steps with VFs and concurrent filter operations while monitoring for leaks via slabinfo or kmemleak; verify lockdep reports are absent under load.

Typical attack path

1. Obtain local root or sufficient privileges on a Linux host with i40e driver and SR-IOV enabled
2. Create multiple VFs and assign port VLANs
3. Issue concurrent macvlan filter add/delete operations from multiple threads or processes
4. Observe mac_filter_hash inconsistency and resulting memory leak

How to detect it

Inspect kernel logs for warnings around i40e mac filter operations; use memory leak detectors such as kmemleak or slabinfo to identify unexpected growth in mac_filter_hash related objects after concurrent VF filter activity; no widespread exploitation artifacts are known.

What your security team should do

• Prioritize kernel upgrades on all systems using i40e adapters with SR-IOV within the next maintenance window
• Monitor for memory pressure on network-heavy workloads until patches are applied
• Enable lockdep in debug kernels during testing to catch similar synchronization issues
• Review SR-IOV and macvlan configurations for unnecessary complexity that increases exposure surface