CVE-2024-26859

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net/bnx2x: Prevent access to a freed page in page_pool

Fix race condition leading to system crash during EEH error handling

During EEH error recovery, the bnx2x driver's transmit timeout logic

could cause a race condition when handling reset tasks. The

bnx2x_tx_timeout() schedules reset tasks via bnx2x_sp_rtnl_task(),

which ultimately leads to bnx2x_nic_unload(). In bnx2x_nic_unload()

SGEs are freed using bnx2x_free_rx_sge_range(). However, this could

overlap with the EEH driver's attempt to reset the device using

bnx2x_io_slot_reset(), which also tries to free SGEs. This race

condition can result in system crashes due to accessing freed memory

locations in bnx2x_free_rx_sge()

799 static inline void bnx2x_free_rx_sge(struct bnx2x *bp,

800 struct bnx2x_fastpath *fp, u16 index)

801 {

802 struct sw_rx_page *sw_buf = &fp->rx_page_ring[index];

803 struct page *page = sw_buf->page;

....

where sw_buf was set to N

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References