CVE-2024-53044

What it actually does

Incomplete error handling in tcf_block_get_ext() after xa_insert() failure leaves the device bound via ndo_setup_tc() FLOW_BLOCK_BIND without a matching FLOW_BLOCK_UNBIND, causing subsequent block operations to fail with busy indications and preventing recovery without driver unbind or reboot.

Why it matters to the business

Network administrators attempting to configure ingress and egress blocks can trigger an irrecoverable state on affected Linux systems, forcing unplanned reboots that interrupt services and increase operational overhead, especially in environments with high kernel prevalence.

How an attack unfolds

An attacker or automated script supplies a tc qdisc replace command requesting the same block index for both ingress and egress on a clsact qdisc; the duplicate xarray insertion fails after the offload bind has already occurred, leaving the flow block permanently busy and requiring manual intervention or reboot to restore functionality.

How to fix it

Upgrade the Linux kernel to a version containing commit 8966eb69a143b1c032365fe84f2815f3c46f2590 or later; apply the corrected tcf_block_get_ext() error path that invokes tcf_block_offload_unbind() on xa_insert() failure.

How to confirm the fix worked

After patching, re-run the failing tc qdisc replace command with duplicate block indices and confirm it now fails cleanly without leaving the block in a busy state; verify subsequent valid block assignments succeed without requiring reboot.

Typical attack path

1. Identify a target Linux system exposing tc configuration interfaces
2. Issue tc qdisc replace command with identical ingress_block and egress_block values
3. Trigger xa_insert() collision in tcf_block_get_ext()
4. Observe irreversible 'Flow block cb is busy' errors on subsequent valid configurations
5. Force system reboot or driver reload to restore network control

How to detect it

Search kernel logs and audit trails for repeated 'dsa_core: Flow block cb is busy' or 'block dev insert failed' messages following tc qdisc operations; correlate with process execution of tc commands and absence of corresponding unbind events in netdevice offload traces.

What your security team should do

• Prioritize kernel updates on all systems exposing net/sched interfaces within the next maintenance window
• Restrict unprivileged access to tc commands via capabilities or SELinux policies
• Monitor for repeated 'Flow block cb is busy' messages in kernel logs as an indicator of misconfiguration or attempted misuse
• Test patched kernels in staging environments that exercise ingress/egress block configurations