Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2024-39502 Details

Description

In the Linux kernel, the following vulnerability has been resolved: ionic: fix use after netif_napi_del() When queues are started, netif_napi_add() and napi_enable() are called. If there are 4 queues and only 3 queues are used for the current configuration, only 3 queues' napi should be registered and enabled. The ionic_qcq_enable() checks whether the .poll pointer is not NULL for enabling only the using queue' napi. Unused queues' napi will not be registered by netif_napi_add(), so the .poll pointer indicates NULL. But it couldn't distinguish whether the napi was unregistered or not because netif_napi_del() doesn't reset the .poll pointer to NULL. So, ionic_qcq_enable() calls napi_enable() for the queue, which was unregistered by netif_napi_del(). Reproducer: ethtool -L <interface name> rx 1 tx 1 combined 0 ethtool -L <interface name> rx 0 tx 0 combined 1 ethtool -L <interface name> rx 0 tx 0 combined 4 Splat looks like: kernel BUG at net/core/dev.c:6666! Oops: invalid opcode: 0000 [#1] PREEMPT SMP NOPTI CPU: 3 PID: 1057 Comm: kworker/3:3 Not tainted 6.10.0-rc2+ #16 Workqueue: events ionic_lif_deferred_work [ionic] RIP: 0010:napi_enable+0x3b/0x40 Code: 48 89 c2 48 83 e2 f6 80 b9 61 09 00 00 00 74 0d 48 83 bf 60 01 00 00 00 74 03 80 ce 01 f0 4f RSP: 0018:ffffb6ed83227d48 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffff97560cda0828 RCX: 0000000000000029 RDX: 0000000000000001 RSI: 0000000000000000 RDI: ffff97560cda0a28 RBP: ffffb6ed83227d50 R08: 0000000000000400 R09: 0000000000000001 R10: 0000000000000001 R11: 0000000000000001 R12: 0000000000000000 R13: ffff97560ce3c1a0 R14: 0000000000000000 R15: ffff975613ba0a20 FS: 0000000000000000(0000) GS:ffff975d5f780000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f8f734ee200 CR3: 0000000103e50000 CR4: 00000000007506f0 PKRU: 55555554 Call Trace: <TASK> ? die+0x33/0x90 ? do_trap+0xd9/0x100 ? napi_enable+0x3b/0x40 ? do_error_trap+0x83/0xb0 ? napi_enable+0x3b/0x40 ? napi_enable+0x3b/0x40 ? exc_invalid_op+0x4e/0x70 ? napi_enable+0x3b/0x40 ? asm_exc_invalid_op+0x16/0x20 ? napi_enable+0x3b/0x40 ionic_qcq_enable+0xb7/0x180 [ionic 59bdfc8a035436e1c4224ff7d10789e3f14643f8] ionic_start_queues+0xc4/0x290 [ionic 59bdfc8a035436e1c4224ff7d10789e3f14643f8] ionic_link_status_check+0x11c/0x170 [ionic 59bdfc8a035436e1c4224ff7d10789e3f14643f8] ionic_lif_deferred_work+0x129/0x280 [ionic 59bdfc8a035436e1c4224ff7d10789e3f14643f8] process_one_work+0x145/0x360 worker_thread+0x2bb/0x3d0 ? __pfx_worker_thread+0x10/0x10 kthread+0xcc/0x100 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x2d/0x50 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30

Metrics

CVSS 3.x Severity and Vector Strings:

NIST: [email protected]CVSS-B:7.8 HIGHVector:CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CNA: kernel.orgCVSS-B:7.8 HIGHVector:CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://cert-portal.siemens.com/productcert/html/ssa-265688.html	siemens-SADP
https://cert-portal.siemens.com/productcert/html/ssa-355557.html	siemens-SADP
https://cert-portal.siemens.com/productcert/html/ssa-613116.html	siemens-SADP
https://git.kernel.org/stable/c/0d19267cb150e8f76ade210e16ee820a77f684e7	kernel.org	Patch
https://git.kernel.org/stable/c/183ebc167a8a19e916b885d4bb61a3491991bfa5	kernel.org	Patch
https://git.kernel.org/stable/c/60cd714871cd5a683353a355cbb17a685245cf84	kernel.org	Patch
https://git.kernel.org/stable/c/79f18a41dd056115d685f3b0a419c7cd40055e13	kernel.org	Patch
https://git.kernel.org/stable/c/8edd18dab443863e9e48f084e7f123fca3065e4e	kernel.org	Patch
https://git.kernel.org/stable/c/a87d72b37b9ec2c1e18fe36b09241d8b30334a2e	kernel.org	Patch
https://git.kernel.org/stable/c/ff9c2a9426ecf5b9631e9fd74993b357262387d6	kernel.org	Patch
https://git.kernel.org/stable/c/0d19267cb150e8f76ade210e16ee820a77f684e7	CVE	Patch
https://git.kernel.org/stable/c/183ebc167a8a19e916b885d4bb61a3491991bfa5	CVE	Patch
https://git.kernel.org/stable/c/60cd714871cd5a683353a355cbb17a685245cf84	CVE	Patch
https://git.kernel.org/stable/c/79f18a41dd056115d685f3b0a419c7cd40055e13	CVE	Patch
https://git.kernel.org/stable/c/8edd18dab443863e9e48f084e7f123fca3065e4e	CVE	Patch
https://git.kernel.org/stable/c/a87d72b37b9ec2c1e18fe36b09241d8b30334a2e	CVE	Patch
https://git.kernel.org/stable/c/ff9c2a9426ecf5b9631e9fd74993b357262387d6	CVE	Patch
https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html	CVE

see all 18 references

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-416	Use After Free	[email protected]

Affected Products

Product	Versions
linux linux kernel	>= 5.4, < 5.4.279 >= 5.5, < 5.10.221 >= 5.11, < 5.15.162 >= 5.16, < 6.1.95 >= 6.2, < 6.6.35
CPE cpe:2.3:o:linux:linux_kernel:::::::: cpe:2.3:o:linux:linux_kernel:6.10:rc1:::::: cpe:2.3:o:linux:linux_kernel:6.10:rc2:::::: cpe:2.3:o:linux:linux_kernel:6.10:rc3:::::: Remediation No remediation found in references.

Change History

9 change records found show changes

Date	Action	Recorded By
Aug 4, 2026	CVE Modified	kernel.org
Jun 17, 2026	CVE Modified	siemens-SADP
Jun 17, 2026	CVE Modified	kernel.org
Jun 17, 2026	CVE Modified	CISA-ADP
May 12, 2026	CVE Modified	siemens-SADP
Nov 3, 2025	CVE Modified	CVE
Sep 17, 2025	Initial Analysis	[email protected]
Nov 21, 2024	CVE Modified	CVE
Jul 12, 2024	New CVE Received	kernel.org