In the Linux kernel, the following vulnerability has been resolved:
ice: move netif_queue_set_napi to rtnl-protected sections
Currently, netif_queue_set_napi() is called from ice_vsi_rebuild() that is not rtnl-locked when called from the reset. This creates the need to take the rtnl_lock just for a single function and complicates the synchronization with .ndo_bpf. At the same time, there no actual need to fill napi-to-queue information at this exact point.
Fill napi-to-queue information when opening the VSI and clear it when the VSI is being closed. Those routines are already rtnl-locked.
Also, rewrite napi-to-queue assignment in a way that prevents inclusion of XDP queues, as this leads to out-of-bounds writes, such as one below.
[ +0.000004] BUG: KASAN: slab-out-of-bounds in netif_queue_set_napi+0x1c2/0x1e0 [ +0.000012] Write of size 8 at addr ffff889881727c80 by task bash/7047 [ +0.000006] CPU: 24 PID: 7047 Comm: bash Not tainted 6.10.0-rc2+ #2 [ +0.000004] Hardware name: Intel Corporation S2600WFT/S2600WFT, BIOS SE5C620.86B.02.01.0014.082620210524 08/26/2021 [ +0.000003] Call Trace: [ +0.000003] <TASK> [ +0.000002] dump_stack_lvl+0x60/0x80 [ +0.000007] print_report+0xce/0x630 [ +0.000007] ? __pfx__raw_spin_lock_irqsave+0x10/0x10 [ +0.000007] ? __virt_addr_valid+0x1c9/0x2c0 [ +0.000005] ? netif_queue_set_napi+0x1c2/0x1e0 [ +0.000003] kasan_report+0xe9/0x120 [ +0.000004] ? netif_queue_set_napi+0x1c2/0x1e0 [ +0.000004] netif_queue_set_napi+0x1c2/0x1e0 [ +0.000005] ice_vsi_close+0x161/0x670 [ice] [ +0.000114] ice_dis_vsi+0x22f/0x270 [ice] [ +0.000095] ice_pf_dis_all_vsi.constprop.0+0xae/0x1c0 [ice] [ +0.000086] ice_prepare_for_reset+0x299/0x750 [ice] [ +0.000087] pci_dev_save_and_disable+0x82/0xd0 [ +0.000006] pci_reset_function+0x12d/0x230 [ +0.000004] reset_store+0xa0/0x100 [ +0.000006] ? __pfx_reset_store+0x10/0x10 [ +0.000002] ? __pfx_mutex_lock+0x10/0x10 [ +0.000004] ? __check_object_size+0x4c1/0x640 [ +0.000007] kernfs_fop_write_iter+0x30b/0x4a0 [ +0.000006] vfs_write+0x5d6/0xdf0 [ +0.000005] ? fd_install+0x180/0x350 [ +0.000005] ? __pfx_vfs_write+0x10/0xA10 [ +0.000004] ? do_fcntl+0x52c/0xcd0 [ +0.000004] ? kasan_save_track+0x13/0x60 [ +0.000003] ? kasan_save_free_info+0x37/0x60 [ +0.000006] ksys_write+0xfa/0x1d0 [ +0.000003] ? __pfx_ksys_write+0x10/0x10 [ +0.000002] ? __x64_sys_fcntl+0x121/0x180 [ +0.000004] ? _raw_spin_lock+0x87/0xe0 [ +0.000005] do_syscall_64+0x80/0x170 [ +0.000007] ? _raw_spin_lock+0x87/0xe0 [ +0.000004] ? __pfx__raw_spin_lock+0x10/0x10 [ +0.000003] ? file_close_fd_locked+0x167/0x230 [ +0.000005] ? syscall_exit_to_user_mode+0x7d/0x220 [ +0.000005] ? do_syscall_64+0x8c/0x170 [ +0.000004] ? do_syscall_64+0x8c/0x170 [ +0.000003] ? do_syscall_64+0x8c/0x170 [ +0.000003] ? fput+0x1a/0x2c0 [ +0.000004] ? filp_close+0x19/0x30 [ +0.000004] ? do_dup2+0x25a/0x4c0 [ +0.000004] ? __x64_sys_dup2+0x6e/0x2e0 [ +0.000002] ? syscall_exit_to_user_mode+0x7d/0x220 [ +0.000004] ? do_syscall_64+0x8c/0x170 [ +0.000003] ? __count_memcg_events+0x113/0x380 [ +0.000005] ? handle_mm_fault+0x136/0x820 [ +0.000005] ? do_user_addr_fault+0x444/0xa80 [ +0.000004] ? clear_bhb_loop+0x25/0x80 [ +0.000004] ? clear_bhb_loop+0x25/0x80 [ +0.000002] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ +0.000005] RIP: 0033:0x7f2033593154
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 27, 2026 | Jul 27, 2026 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Sep 18, 2024 |
| Suse | — | Upgrade kernel-syms-azureUpgrade cluster-md-kmp-azureUpgrade dtb-amlogicUpgrade kernel-docs-htmlUpgrade dtb-exynosUpgrade dtb-mediatekUpgrade kernel-default-base-rebuildUpgrade kernel-kvmsmallUpgrade kernel-rtUpgrade kernel-azure-vdsoUpgrade kernel-azure-extraUpgrade kernel-rt_debug-vdsoUpgrade kernel-symsUpgrade kernel-syms-rtUpgrade dlm-kmp-azureUpgrade ocfs2-kmp-rtUpgrade dtb-lgUpgrade kernel-64kb-optionalUpgrade dtb-hisiliconUpgrade dtb-broadcomUpgrade kernel-obs-qaUpgrade dtb-freescaleUpgrade kernel-azure-livepatch-develUpgrade kernel-azure-optionalUpgrade kernel-64kb-develUpgrade kernel-devel-azureUpgrade gfs2-kmp-64kbUpgrade kernel-64kbUpgrade kernel-devel-rtUpgrade dtb-amazonUpgrade kernel-rt-develUpgrade kernel-zfcpdumpUpgrade kernel-source-azureUpgrade cluster-md-kmp-defaultUpgrade kernel-default-livepatchUpgrade kernel-macrosUpgrade dtb-apmUpgrade gfs2-kmp-rtUpgrade kernel-sourceUpgrade kselftests-kmp-64kbUpgrade dtb-qcomUpgrade ocfs2-kmp-64kbUpgrade kernel-azure-develUpgrade kernel-default-vdsoUpgrade dlm-kmp-64kbUpgrade kernel-kvmsmall-develUpgrade dtb-armUpgrade kernel-default-extraUpgrade kernel-rt-livepatch-develUpgrade kernel-default-develUpgrade dtb-rockchipUpgrade dtb-marvellUpgrade kernel-default-baseUpgrade kernel-debug-vdsoUpgrade gfs2-kmp-azureUpgrade dtb-socionextUpgrade kernel-rt_debug-develUpgrade kselftests-kmp-defaultUpgrade kernel-rt-optionalUpgrade kernel-debugUpgrade reiserfs-kmp-64kbUpgrade dtb-nvidiaUpgrade cluster-md-kmp-64kbUpgrade dtb-appleUpgrade kernel-rt-vdsoUpgrade kernel-debug-develUpgrade dtb-sprdUpgrade ocfs2-kmp-defaultUpgrade reiserfs-kmp-azureUpgrade kselftests-kmp-azureUpgrade kernel-source-rtUpgrade dtb-caviumUpgrade dtb-alteraUpgrade dlm-kmp-defaultUpgrade kernel-default-livepatch-develUpgrade dlm-kmp-rtUpgrade kernel-azureUpgrade dtb-amdUpgrade cluster-md-kmp-rtUpgrade kernel-rt-extraUpgrade kernel-develUpgrade dtb-renesasUpgrade reiserfs-kmp-defaultUpgrade ocfs2-kmp-azureUpgrade kernel-source-vanillaUpgrade dtb-allwinnerUpgrade kernel-rt_debugUpgrade kernel-obs-buildUpgrade reiserfs-kmp-rtUpgrade gfs2-kmp-defaultUpgrade kernel-64kb-extraUpgrade dtb-xilinxUpgrade kernel-rt_debug-livepatch-develUpgrade kselftests-kmp-rtUpgrade kernel-docsUpgrade kernel-kvmsmall-vdsoUpgrade kernel-default-optionalUpgrade kernel-default | Dec 5, 2025 | Nov 13, 2024 |
| Ubuntu | — | Upgrade linux-image-oracleUpgrade linux-image-virtual-hwe-22.04Upgrade linux-image-lowlatency-64kUpgrade linux-image-generic-64kUpgrade linux-image-lowlatency-64k-hwe-24.04Upgrade linux-image-genericUpgrade linux-image-nvidiaUpgrade linux-image-oracle-64kUpgrade linux-image-nvidia-64kUpgrade linux-image-generic-hwe-22.04Upgrade linux-image-6.8.0-1020-azureUpgrade linux-image-6.8.0-1017-oracleUpgrade linux-image-oem-22.04bUpgrade linux-image-oem-22.04Upgrade linux-image-oem-24.04aUpgrade linux-image-6.8.0-1019-nvidiaUpgrade linux-image-oem-22.04cUpgrade linux-image-6.8.0-1018-oemUpgrade linux-image-6.8.0-50-generic-64kUpgrade linux-image-gkeUpgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-generic-hwe-24.04Upgrade linux-image-virtualUpgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-virtual-hwe-24.04Upgrade linux-image-6.8.0-1002-gkeopUpgrade linux-image-6.8.0-1019-nvidia-lowlatencyUpgrade linux-image-gkeopUpgrade linux-image-gcpUpgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-oem-24.04Upgrade linux-image-oem-22.04dUpgrade linux-image-generic-lpaeUpgrade linux-image-6.8.0-1020-awsUpgrade linux-image-6.8.0-50-lowlatency-64kUpgrade linux-image-6.8.0-50-genericUpgrade linux-image-ibm-lts-24.04Upgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-azureUpgrade linux-image-raspiUpgrade linux-image-lowlatency-hwe-24.04Upgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-oem-22.04aUpgrade linux-image-ibm-classicUpgrade linux-image-ibmUpgrade linux-image-6.8.0-1019-gcpUpgrade linux-image-gkeop-6.8Upgrade linux-image-6.8.0-1016-raspiUpgrade linux-image-kvmUpgrade linux-image-lowlatencyUpgrade linux-image-nvidia-6.8Upgrade linux-image-awsUpgrade linux-image-6.8.0-50-lowlatencyUpgrade linux-image-6.8.0-1017-oracle-64kUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-nvidia-64k-6.8Upgrade linux-image-6.8.0-1019-nvidia-64kUpgrade linux-image-6.8.0-1019-nvidia-lowlatency-64kUpgrade linux-image-azure-fdeUpgrade linux-image-6.8.0-1020-azure-fdeUpgrade linux-image-6.8.0-1017-ibmUpgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-6.8.0-1015-gkeUpgrade linux-image-nvidia-lowlatency-64k | Dec 13, 2024 | Sep 18, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub