CVE-2024-44932

In the Linux kernel, the following vulnerability has been resolved:

idpf: fix UAFs when destroying the queues

The second tagged commit started sometimes (very rarely, but possible) throwing WARNs from net/core/page_pool.c:page_pool_disable_direct_recycling(). Turned out idpf frees interrupt vectors with embedded NAPIs before freeing the queues making page_pools' NAPI pointers lead to freed memory before these pools are destroyed by libeth. It's not clear whether there are other accesses to the freed vectors when destroying the queues, but anyway, we usually free queue/interrupt vectors only when the queues are destroyed and the NAPIs are guaranteed to not be referenced anywhere.

Invert the allocation and freeing logic making queue/interrupt vectors be allocated first and freed last. Vectors don't require queues to be present, so this is safe. Additionally, this change allows to remove that useless queue->q_vector pointer cleanup, as vectors are still valid when freeing the queues (+ both are freed within one function, so it's not clear why nullify the pointers at all).

This vulnerability is rated as having a Moderate severity rather than Important because exploitation requires elevated administrative privileges to manipulate network device queues, and exposure is restricted to hardware equipped with Intel Infrastructure Data Path Function (IDPF) devices. Under standard Red Hat Enterprise Linux installations, the flaw cannot be triggered by unprivileged or remote network actors. A privileged local user manipulating device interfaces could trigger the flaw during queue teardown, resulting in a denial of service through a kernel crash or potential memory corruption.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.