CVE-2024-35958

This is a vulnerability in the Linux kernel's Elastic Network Adapter (ENA) driver, which manages network interfaces on certain platforms. The driver utilizes two types of transmit (TX) queues: one for packets from the network stack and another for packets directed by XDP (eXpress Data Path) operations. The function ena_free_tx_bufs() is responsible for unmapping and freeing descriptors of uncompleted TX transactions. However, it incorrectly assumes that all TX queues handle packets from the network stack, leading to improper handling of descriptors in XDP-specific queues. This mismanagement can result in descriptors not being freed correctly, potentially causing system crashes, especially during a Virtual Function (VF) reset. The issue has been resolved by updating the driver to correctly differentiate between the two types of TX queues, ensuring proper descriptor management. Users are advised to update their Linux kernel to a version that includes this fix to maintain system stability.

Red Hat rates this vulnerability as Moderate because exploitation is restricted to environments utilizing Amazon Elastic Network Adapter (ENA) devices with active eXpress Data Path (XDP) programs, resulting exclusively in a denial of service. The flaw cannot be triggered remotely without local privileged configuration or specific network conditions that induce a virtual function reset while handling XDP traffic. Deployments outside of Amazon Web Services or systems not configuring XDP forwarding on ENA interfaces are unaffected by this condition.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.