In the Linux kernel, the following vulnerability has been resolved:
ice: move netif_queue_set_napi to rtnl-protected sections
Currently, netif_queue_set_napi() is called from ice_vsi_rebuild() that is not rtnl-locked when called from the reset. This creates the need to take the rtnl_lock just for a single function and complicates the synchronization with .ndo_bpf. At the same time, there no actual need to fill napi-to-queue information at this exact point.
Fill napi-to-queue information when opening the VSI and clear it when the VSI is being closed. Those routines are already rtnl-locked.
Also, rewrite napi-to-queue assignment in a way that prevents inclusion of XDP queues, as this leads to out-of-bounds writes, such as one below.
[ +0.000004] BUG: KASAN: slab-out-of-bounds in netif_queue_set_napi+0x1c2/0x1e0 [ +0.000012] Write of size 8 at addr ffff889881727c80 by task bash/7047 [ +0.000006] CPU: 24 PID: 7047 Comm: bash Not tainted 6.10.0-rc2+ #2 [ +0.000004] Hardware name: Intel Corporation S2600WFT/S2600WFT, BIOS SE5C620.86B.02.01.0014.082620210524 08/26/2021 [ +0.000003] Call Trace: [ +0.000003] <TASK> [ +0.000002] dump_stack_lvl+0x60/0x80 [ +0.000007] print_report+0xce/0x630 [ +0.000007] ? __pfx__raw_spin_lock_irqsave+0x10/0x10 [ +0.000007] ? __virt_addr_valid+0x1c9/0x2c0 [ +0.000005] ? netif_queue_set_napi+0x1c2/0x1e0 [ +0.000003] kasan_report+0xe9/0x120 [ +0.000004] ? netif_queue_set_napi+0x1c2/0x1e0 [ +0.000004] netif_queue_set_napi+0x1c2/0x1e0 [ +0.000005] ice_vsi_close+0x161/0x670 [ice] [ +0.000114] ice_dis_vsi+0x22f/0x270 [ice] [ +0.000095] ice_pf_dis_all_vsi.constprop.0+0xae/0x1c0 [ice] [ +0.000086] ice_prepare_for_reset+0x299/0x750 [ice] [ +0.000087] pci_dev_save_and_disable+0x82/0xd0 [ +0.000006] pci_reset_function+0x12d/0x230 [ +0.000004] reset_store+0xa0/0x100 [ +0.000006] ? __pfx_reset_store+0x10/0x10 [ +0.000002] ? __pfx_mutex_lock+0x10/0x10 [ +0.000004] ? __check_object_size+0x4c1/0x640 [ +0.000007] kernfs_fop_write_iter+0x30b/0x4a0 [ +0.000006] vfs_write+0x5d6/0xdf0 [ +0.000005] ? fd_install+0x180/0x350 [ +0.000005] ? __pfx_vfs_write+0x10/0xA10 [ +0.000004] ? do_fcntl+0x52c/0xcd0 [ +0.000004] ? kasan_save_track+0x13/0x60 [ +0.000003] ? kasan_save_free_info+0x37/0x60 [ +0.000006] ksys_write+0xfa/0x1d0 [ +0.000003] ? __pfx_ksys_write+0x10/0x10 [ +0.000002] ? __x64_sys_fcntl+0x121/0x180 [ +0.000004] ? _raw_spin_lock+0x87/0xe0 [ +0.000005] do_syscall_64+0x80/0x170 [ +0.000007] ? _raw_spin_lock+0x87/0xe0 [ +0.000004] ? __pfx__raw_spin_lock+0x10/0x10 [ +0.000003] ? file_close_fd_locked+0x167/0x230 [ +0.000005] ? syscall_exit_to_user_mode+0x7d/0x220 [ +0.000005] ? do_syscall_64+0x8c/0x170 [ +0.000004] ? do_syscall_64+0x8c/0x170 [ +0.000003] ? do_syscall_64+0x8c/0x170 [ +0.000003] ? fput+0x1a/0x2c0 [ +0.000004] ? filp_close+0x19/0x30 [ +0.000004] ? do_dup2+0x25a/0x4c0 [ +0.000004] ? __x64_sys_dup2+0x6e/0x2e0 [ +0.000002] ? syscall_exit_to_user_mode+0x7d/0x220 [ +0.000004] ? do_syscall_64+0x8c/0x170 [ +0.000003] ? __count_memcg_events+0x113/0x380 [ +0.000005] ? handle_mm_fault+0x136/0x820 [ +0.000005] ? do_user_addr_fault+0x444/0xa80 [ +0.000004] ? clear_bhb_loop+0x25/0x80 [ +0.000004] ? clear_bhb_loop+0x25/0x80 [ +0.000002] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ +0.000005] RIP: 0033:0x7f2033593154
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 27, 2026 | Jul 27, 2026 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Sep 18, 2024 |
| Suse | — | Upgrade kernel-default-vdsoUpgrade kselftests-kmp-64kbUpgrade kernel-azure-extraUpgrade kernel-azure-develUpgrade dtb-armUpgrade ocfs2-kmp-64kbUpgrade kernel-default-extraUpgrade gfs2-kmp-rtUpgrade dlm-kmp-azureUpgrade dtb-exynosUpgrade kernel-rt-livepatch-develUpgrade kernel-default-develUpgrade kernel-kvmsmall-develUpgrade dtb-amlogicUpgrade dtb-freescaleUpgrade dtb-hisiliconUpgrade kernel-rt-develUpgrade kernel-azure-livepatch-develUpgrade kernel-azure-optionalUpgrade kernel-64kb-develUpgrade kernel-devel-azureUpgrade kernel-source-azureUpgrade dtb-amazonUpgrade dtb-apmUpgrade dtb-qcomUpgrade kernel-default-livepatchUpgrade kernel-sourceUpgrade dtb-broadcomUpgrade kernel-zfcpdumpUpgrade kernel-default-base-rebuildUpgrade kernel-obs-qaUpgrade gfs2-kmp-64kbUpgrade kernel-64kbUpgrade kernel-rt_debug-vdsoUpgrade kernel-symsUpgrade kernel-rtUpgrade kernel-syms-rtUpgrade kernel-docs-htmlUpgrade kernel-azure-vdsoUpgrade kernel-kvmsmallUpgrade cluster-md-kmp-defaultUpgrade ocfs2-kmp-rtUpgrade dtb-lgUpgrade kernel-64kb-optionalUpgrade kernel-syms-azureUpgrade dlm-kmp-64kbUpgrade cluster-md-kmp-azureUpgrade dtb-mediatekUpgrade kernel-devel-rtUpgrade kernel-macrosUpgrade cluster-md-kmp-rtUpgrade dtb-sprdUpgrade kselftests-kmp-rtUpgrade kernel-rt_debugUpgrade kselftests-kmp-azureUpgrade kernel-default-livepatch-develUpgrade ocfs2-kmp-defaultUpgrade reiserfs-kmp-azureUpgrade kernel-source-rtUpgrade kernel-debug-develUpgrade kernel-default-baseUpgrade dlm-kmp-rtUpgrade dtb-amdUpgrade kernel-azureUpgrade kernel-defaultUpgrade kernel-debug-vdsoUpgrade gfs2-kmp-defaultUpgrade gfs2-kmp-azureUpgrade dtb-xilinxUpgrade dtb-socionextUpgrade dtb-rockchipUpgrade dtb-marvellUpgrade dtb-alteraUpgrade reiserfs-kmp-rtUpgrade kernel-rt_debug-develUpgrade kernel-rt_debug-livepatch-develUpgrade dlm-kmp-defaultUpgrade kernel-64kb-extraUpgrade kernel-docsUpgrade kernel-kvmsmall-vdsoUpgrade kernel-default-optionalUpgrade kernel-rt-extraUpgrade ocfs2-kmp-azureUpgrade kernel-source-vanillaUpgrade kernel-develUpgrade kernel-rt-vdsoUpgrade reiserfs-kmp-defaultUpgrade dtb-renesasUpgrade kernel-rt-optionalUpgrade kernel-debugUpgrade dtb-nvidiaUpgrade cluster-md-kmp-64kbUpgrade reiserfs-kmp-64kbUpgrade kselftests-kmp-defaultUpgrade dtb-appleUpgrade dtb-allwinnerUpgrade kernel-obs-buildUpgrade dtb-cavium | Dec 5, 2025 | Nov 13, 2024 |
| Ubuntu | — | Upgrade linux-image-oem-24.04Upgrade linux-image-gcpUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-6.8.0-50-generic-64kUpgrade linux-image-oracleUpgrade linux-image-6.8.0-1017-oracleUpgrade linux-image-generic-hwe-22.04Upgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-oem-22.04bUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-oem-24.04aUpgrade linux-image-gkeUpgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-lowlatency-64k-hwe-24.04Upgrade linux-image-6.8.0-1002-gkeopUpgrade linux-image-oem-22.04Upgrade linux-image-6.8.0-1018-oemUpgrade linux-image-6.8.0-1020-azureUpgrade linux-image-nvidia-64kUpgrade linux-image-oracle-64kUpgrade linux-image-oem-22.04cUpgrade linux-image-generic-64kUpgrade linux-image-genericUpgrade linux-image-gkeopUpgrade linux-image-virtual-hwe-22.04Upgrade linux-image-6.8.0-1019-nvidiaUpgrade linux-image-nvidiaUpgrade linux-image-virtualUpgrade linux-image-6.8.0-1019-nvidia-lowlatencyUpgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-lowlatency-64kUpgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-gkeop-6.8Upgrade linux-image-6.8.0-1019-gcpUpgrade linux-image-ibm-lts-24.04Upgrade linux-image-lowlatency-hwe-24.04Upgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-raspiUpgrade linux-image-6.8.0-1020-awsUpgrade linux-image-oem-22.04dUpgrade linux-image-oem-22.04aUpgrade linux-image-ibm-classicUpgrade linux-image-ibmUpgrade linux-image-nvidia-64k-6.8Upgrade linux-image-6.8.0-1017-oracle-64kUpgrade linux-image-lowlatencyUpgrade linux-image-kvmUpgrade linux-image-nvidia-6.8Upgrade linux-image-6.8.0-50-lowlatencyUpgrade linux-image-6.8.0-1016-raspiUpgrade linux-image-azure-fdeUpgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-6.8.0-1019-nvidia-64kUpgrade linux-image-6.8.0-1019-nvidia-lowlatency-64kUpgrade linux-image-6.8.0-1015-gkeUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-azureUpgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-6.8.0-1020-azure-fdeUpgrade linux-image-awsUpgrade linux-image-6.8.0-50-lowlatency-64kUpgrade linux-image-6.8.0-50-genericUpgrade linux-image-generic-lpaeUpgrade linux-image-6.8.0-1017-ibm | Dec 13, 2024 | Sep 18, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub