CVE-2024-35958 Details
Description
In the Linux kernel, the following vulnerability has been resolved: net: ena: Fix incorrect descriptor free behavior ENA has two types of TX queues: - queues which only process TX packets arriving from the network stack - queues which only process TX packets forwarded to it by XDP_REDIRECT or XDP_TX instructions The ena_free_tx_bufs() cycles through all descriptors in a TX queue and unmaps + frees every descriptor that hasn't been acknowledged yet by the device (uncompleted TX transactions). The function assumes that the processed TX queue is necessarily from the first category listed above and ends up using napi_consume_skb() for descriptors belonging to an XDP specific queue. This patch solves a bug in which, in case of a VF reset, the descriptors aren't freed correctly, leading to crashes.
A vulnerability has been identified in the Linux kernel's Elastic Network Adapter (ENA) driver, specifically in the handling of transmission (TX) queue descriptors. ENA has two types of TX queues: one for packets from the network stack and another for packets forwarded via XDP (eBPF's eXpress Data Path) instructions. The issue arises in the 'ena_free_tx_bufs()' function, which incorrectly assumes that all processed TX queues are of the first type. This misalignment causes the function to use 'napi_consume_skb()'—a standard method for freeing SKB (socket buffer) structures—on descriptors from the XDP-specific queue, leading to improper management of TX transactions. As a result, in the event of a Virtual Function (VF) reset, some descriptors are not freed correctly, causing system crashes.
Users can update to the latest version of the Linux kernel where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 29, 2024References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| NVD-CWE-noinfo | Insufficient Information to Classify Weakness | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 5.6, < 5.10.216 >= 5.11, < 5.15.156 >= 5.16, < 6.1.87 >= 6.2, < 6.6.28 >= 6.7, < 6.8.7 6.9 rc1 6.9 rc2 6.9 rc3 |
CPE
Remediation
| |
| debian debian linux | 10.0 |
CPE
Remediation
| |
Change History
12 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 4, 2026 | CVE Modified | kernel.org |
| Jun 17, 2026 | CVE Modified | kernel.org |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 17, 2026 | CVE Modified | siemens-SADP |
| May 12, 2026 | CVE Modified | siemens-SADP |
| Dec 17, 2025 | Initial Analysis | [email protected] |
| Nov 21, 2024 | CVE Modified | CVE |
| Nov 5, 2024 | CVE Modified | kernel.org |
| Oct 31, 2024 | CVE Modified | CISA-ADP |
| Jun 25, 2024 | CVE Modified | kernel.org |
| May 29, 2024 | CVE Modified | kernel.org |
| May 20, 2024 | New CVE Received | kernel.org |