CVE-2024-57994
Medium · 5.5CVSS
5.5
EPSS
0.2%
Published
Feb 27, 2025
CISA due date
—
Cloudanix analysis
A flaw in the Linux kernel's handling of network buffer queues could let local changes to network settings cause unexpected system warnings or instability.
- Exploitation
- Local Privilege
- Attacker needs
- Low Privilege
- Complexity
- Low
- Impact
- Denial Of Service
- Component
- OS kernel
- Class
- Race Condition
- Remediation
- Upgrade
- Effort
- Medium
- Patch risk
- Low
What it actually does
The ptr_ring_resize_multiple() function blocks hard interrupts instead of only BH, violating lockdep expectations in page_pool_put_unrefed_netmem and allowing potential interrupt-context issues during queue resize operations in networking paths such as tun devices.
Why it matters to the business
May trigger kernel warnings or instability during network interface configuration changes on Linux systems, increasing operational risk for high-availability or virtualized environments until patched; widespread kernel usage amplifies exposure.
How an attack unfolds
A local attacker triggers netdevice notifier events (for example via tun device queue length changes) that invoke ptr_ring_resize_multiple while page pool operations are active, causing the hardirq blocking violation and lockdep splat that can lead to availability impact.
How to fix it
Apply the upstream fix in commit 572777a258c048e0d0fb3a0c47430eadcefe80c0 or later stable kernels; update to versions where ptr_ring_resize_multiple is renamed to ptr_ring_resize_multiple_bh and only blocks BH.
How to confirm the fix worked
Confirm the presence of the fix commit in the running kernel source; verify no lockdep splats appear in dmesg when exercising tun or netdevice queue resize paths; check for updated function names in ptr_ring.h.
Typical attack path
- Obtain local user privileges on an affected Linux system
- Perform operations that change network device tx queue length or trigger tun device events
- Invoke call_netdevice_notifiers leading to ptr_ring resize in hardirq-masked context
- Trigger page pool put operations that hit the lockdep assertion
How to detect it
Review kernel logs for the specific page_pool_put_unrefed_netmem warning and stack traces involving tun_ptr_free or ptr_ring_resize_multiple; correlate with netlink or rtnl_setlink activity in audit logs.
What your security team should do
- Prioritize patching Linux kernels on systems handling network configuration or virtualization workloads
- Monitor for related kernel privilege-escalation patterns in the same subsystem
- Test the fix in staging environments before broad deployment due to networking impact
The record
In the Linux kernel, the following vulnerability has been resolved: ptr_ring: do not block hard interrupts in ptr_ring_resize_multiple() Jakub added a lockdep_assert_no_hardirq() check in __page_pool_put_page() to increase test coverage. syzbot found a splat caused by hard irq blocking in ptr_ring_resize_multiple() [1] As current users of ptr_ring_resize_multiple() do not require hard irqs being masked, replace it to only block BH. Rename helpers to better reflect they are safe against BH only. - ptr_ring_resize_multiple() to ptr_ring_resize_multiple_bh() - skb_array_resize_multiple() to skb_array_resize_multiple_bh() [1] WARNING: CPU: 1 PID: 9150 at net/core/page_pool.c:709 __page_pool_put_page net/core/page_pool.c:709 [inline] WARNING: CPU: 1 PID: 9150 at net/core/page_pool.c:709 page_pool_put_unrefed_netmem+0x157/0xa40 net/core/page_pool.c:780 Modules linked in: CPU: 1 UID: 0 PID: 9150 Comm: syz.1.1052 Not tainted 6.11.0-rc3-syzkaller-00202-gf8669d7b5f5d #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024 RIP: 0010:__page_pool_put_page net/core/page_pool.c:709 [inline] RIP: 0010:page_pool_put_unrefed_netmem+0x157/0xa40 net/core/page_pool.c:780 Code: 74 0e e8 7c aa fb f7 eb 43 e8 75 aa fb f7 eb 3c 65 8b 1d 38 a8 6a 76 31 ff 89 de e8 a3 ae fb f7 85 db 74 0b e8 5a aa fb f7 90 <0f> 0b 90 eb 1d 65 8b 1d 15 a8 6a 76 31 ff 89 de e8 84 ae fb f7 85 RSP: 0018:ffffc9000bda6b58 EFLAGS: 00010083 RAX: ffffffff8997e523 RBX: 0000000000000000 RCX: 0000000000040000 RDX: ffffc9000fbd0000 RSI: 0000000000001842 RDI: 0000000000001843 RBP: 0000000000000000 R08: ffffffff8997df2c R09: 1ffffd40003a000d R10: dffffc0000000000 R11: fffff940003a000e R12: ffffea0001d00040 R13: ffff88802e8a4000 R14: dffffc0000000000 R15: 00000000ffffffff FS: 00007fb7aaf716c0(0000) GS:ffff8880b9300000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fa15a0d4b72 CR3: 00000000561b0000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> tun_ptr_free drivers/net/tun.c:617 [inline] __ptr_ring_swap_queue include/linux/ptr_ring.h:571 [inline] ptr_ring_resize_multiple_noprof include/linux/ptr_ring.h:643 [inline] tun_queue_resize drivers/net/tun.c:3694 [inline] tun_device_event+0xaaf/0x1080 drivers/net/tun.c:3714 notifier_call_chain+0x19f/0x3e0 kernel/notifier.c:93 call_netdevice_notifiers_extack net/core/dev.c:2032 [inline] call_netdevice_notifiers net/core/dev.c:2046 [inline] dev_change_tx_queue_len+0x158/0x2a0 net/core/dev.c:9024 do_setlink+0xff6/0x41f0 net/core/rtnetlink.c:2923 rtnl_setlink+0x40d/0x5a0 net/core/rtnetlink.c:3201 rtnetlink_rcv_msg+0x73f/0xcf0 net/core/rtnetlink.c:6647 netlink_rcv_skb+0x1e3/0x430 net/netlink/af_netlink.c:2550
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Debian:13 | linux | 0 | No fix |
| Debian:13 | linux | 0 | 6.12.13-1 |
| Linux | Kernel | 6.6.0 | 6.12.13 |
| Linux | Kernel | 6.6.0 | 6.6.123 |
| SUSE:Linux Enterprise High Availability Extension 15 SP6 | kernel-default | 0 | 6.4.0-150600.23.42.2 |
| SUSE:Linux Enterprise Live Patching 15 SP6 | kernel-default | 0 | 6.4.0-150600.23.42.2 |
| SUSE:Linux Enterprise Live Patching 15 SP6 | kernel-livepatch-SLE15-SP6-RT_Update_9 | 0 | 1-150600.1.3.2 |
| SUSE:Linux Enterprise Live Patching 15 SP6 | kernel-livepatch-SLE15-SP6_Update_9 | 0 | 1-150600.13.3.4 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP6 | kernel-64kb | 0 | 6.4.0-150600.23.42.2 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP6 | kernel-default | 0 | 6.4.0-150600.23.42.2 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP6 | kernel-default-base | 0 | 6.4.0-150600.23.42.2.150600.12.18.4 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP6 | kernel-source | 0 | 6.4.0-150600.23.42.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP6 | kernel-zfcpdump | 0 | 6.4.0-150600.23.42.2 |
| SUSE:Linux Enterprise Module for Confidential Computing Technical Preview 15 SP6 | kernel-coco | 0 | 6.4.0-15061.21.coco15sp6.1 |
| SUSE:Linux Enterprise Module for Confidential Computing Technical Preview 15 SP6 | kernel-coco_debug | 0 | 6.4.0-15061.21.coco15sp6.1 |
| SUSE:Linux Enterprise Module for Confidential Computing Technical Preview 15 SP6 | kernel-source-coco | 0 | 6.4.0-15061.21.coco15sp6.1 |
| SUSE:Linux Enterprise Module for Confidential Computing Technical Preview 15 SP6 | kernel-syms-coco | 0 | 6.4.0-15061.21.coco15sp6.1 |
| SUSE:Linux Enterprise Module for Development Tools 15 SP6 | kernel-docs | 0 | 6.4.0-150600.23.42.1 |
| SUSE:Linux Enterprise Module for Development Tools 15 SP6 | kernel-obs-build | 0 | 6.4.0-150600.23.42.2 |
| SUSE:Linux Enterprise Module for Development Tools 15 SP6 | kernel-source | 0 | 6.4.0-150600.23.42.1 |
| SUSE:Linux Enterprise Module for Development Tools 15 SP6 | kernel-syms | 0 | 6.4.0-150600.23.42.1 |
| SUSE:Linux Enterprise Module for Legacy 15 SP6 | kernel-default | 0 | 6.4.0-150600.23.42.2 |
| SUSE:Linux Enterprise Module for Public Cloud 15 SP6 | kernel-azure | 0 | 6.4.0-150600.8.31.1 |
| SUSE:Linux Enterprise Module for Public Cloud 15 SP6 | kernel-source-azure | 0 | 6.4.0-150600.8.31.1 |
| SUSE:Linux Enterprise Module for Public Cloud 15 SP6 | kernel-syms-azure | 0 | 6.4.0-150600.8.31.1 |
| SUSE:Linux Enterprise Workstation Extension 15 SP6 | kernel-default | 0 | 6.4.0-150600.23.42.2 |
| SUSE:Real Time Module 15 SP6 | kernel-rt | 0 | 6.4.0-150600.10.29.1 |
| SUSE:Real Time Module 15 SP6 | kernel-rt_debug | 0 | 6.4.0-150600.10.29.1 |
| SUSE:Real Time Module 15 SP6 | kernel-source-rt | 0 | 6.4.0-150600.10.29.1 |
| SUSE:Real Time Module 15 SP6 | kernel-syms-rt | 0 | 6.4.0-150600.10.29.1 |
| Ubuntu:24.10 | linux-aws | 0 | 6.11.0-1014.15 |
| openSUSE:Leap 15.6 | dtb-aarch64 | 0 | 6.4.0-150600.23.42.1 |
| openSUSE:Leap 15.6 | kernel-64kb | 0 | 6.4.0-150600.23.42.2 |
| openSUSE:Leap 15.6 | kernel-azure | 0 | 6.4.0-150600.8.31.1 |
| openSUSE:Leap 15.6 | kernel-debug | 0 | 6.4.0-150600.23.42.2 |
| openSUSE:Leap 15.6 | kernel-default | 0 | 6.4.0-150600.23.42.2 |
| openSUSE:Leap 15.6 | kernel-default-base | 0 | 6.4.0-150600.23.42.2.150600.12.18.4 |
| openSUSE:Leap 15.6 | kernel-docs | 0 | 6.4.0-150600.23.42.1 |
| openSUSE:Leap 15.6 | kernel-kvmsmall | 0 | 6.4.0-150600.23.42.2 |
| openSUSE:Leap 15.6 | kernel-obs-build | 0 | 6.4.0-150600.23.42.2 |
| openSUSE:Leap 15.6 | kernel-obs-qa | 0 | 6.4.0-150600.23.42.1 |
| openSUSE:Leap 15.6 | kernel-rt | 0 | 6.4.0-150600.10.29.1 |
| openSUSE:Leap 15.6 | kernel-rt_debug | 0 | 6.4.0-150600.10.29.1 |
| openSUSE:Leap 15.6 | kernel-source | 0 | 6.4.0-150600.23.42.1 |
| openSUSE:Leap 15.6 | kernel-source-azure | 0 | 6.4.0-150600.8.31.1 |
| openSUSE:Leap 15.6 | kernel-source-rt | 0 | 6.4.0-150600.10.29.1 |
| openSUSE:Leap 15.6 | kernel-syms | 0 | 6.4.0-150600.23.42.1 |
| openSUSE:Leap 15.6 | kernel-syms-azure | 0 | 6.4.0-150600.8.31.1 |
| openSUSE:Leap 15.6 | kernel-syms-rt | 0 | 6.4.0-150600.10.29.1 |
| openSUSE:Leap 15.6 | kernel-zfcpdump | 0 | 6.4.0-150600.23.42.2 |
Related vulnerabilities
- CVE-2025-39885 In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix recursive… Also affects linux
- CVE-2025-39883 In the Linux kernel, the following vulnerability has been resolved: mm/memory-failure… Also affects linux
- CVE-2025-39884 In the Linux kernel, the following vulnerability has been resolved: btrfs: fix subvolume… Also affects linux
- CVE-2025-39886 In the Linux kernel, the following vulnerability has been resolved: bpf: Tell memcg to… Also affects linux
- CVE-2025-39876 In the Linux kernel, the following vulnerability has been resolved: net: fec: Fix… Also affects linux
- CVE-2025-39880 In the Linux kernel, the following vulnerability has been resolved: libceph: fix invalid… Also affects linux
- CVE-2025-39881 In the Linux kernel, the following vulnerability has been resolved: kernfs: Fix UAF in… Also affects linux
- CVE-2025-39882 In the Linux kernel, the following vulnerability has been resolved: drm/mediatek: fix… Also affects linux