CVE-2024-46828

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

sched: sch_cake: fix bulk flow accounting logic for host fairness

In sch_cake, we keep track of the count of active bulk flows per host,

when running in dst/src host fairness mode, which is used as the

round-robin weight when iterating through flows. The count of active

bulk flows is updated whenever a flow changes state.

This has a peculiar interaction with the hash collision handling: when a

hash collision occurs (after the set-associative hashing), the state of

the hash bucket is simply updated to match the new packet that collided,

and if host fairness is enabled, that also means assigning new per-host

state to the flow. For this reason, the bulk flow counters of the

host(s) assigned to the flow are decremented, before new state is

assigned (and the counters, which may not belong to the same host

anymore, are incremented again).

Back when this code was introduced, the host fairness mode was always

enabled, so t

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References