{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2024-41036", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-07-12T12:17:45.620Z", "datePublished": "2024-07-29T14:31:50.669Z", "dateUpdated": "2026-08-05T11:34:52.816Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:34:52.816Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ks8851: Fix deadlock with the SPI chip variant\n\nWhen SMP is enabled and spinlocks are actually functional then there is\na deadlock with the 'statelock' spinlock between ks8851_start_xmit_spi\nand ks8851_irq:\n\n watchdog: BUG: soft lockup - CPU#0 stuck for 27s!\n call trace:\n queued_spin_lock_slowpath+0x100/0x284\n do_raw_spin_lock+0x34/0x44\n ks8851_start_xmit_spi+0x30/0xb8\n ks8851_start_xmit+0x14/0x20\n netdev_start_xmit+0x40/0x6c\n dev_hard_start_xmit+0x6c/0xbc\n sch_direct_xmit+0xa4/0x22c\n __qdisc_run+0x138/0x3fc\n qdisc_run+0x24/0x3c\n net_tx_action+0xf8/0x130\n handle_softirqs+0x1ac/0x1f0\n __do_softirq+0x14/0x20\n ____do_softirq+0x10/0x1c\n call_on_irq_stack+0x3c/0x58\n do_softirq_own_stack+0x1c/0x28\n __irq_exit_rcu+0x54/0x9c\n irq_exit_rcu+0x10/0x1c\n el1_interrupt+0x38/0x50\n el1h_64_irq_handler+0x18/0x24\n el1h_64_irq+0x64/0x68\n __netif_schedule+0x6c/0x80\n netif_tx_wake_queue+0x38/0x48\n ks8851_irq+0xb8/0x2c8\n irq_thread_fn+0x2c/0x74\n irq_thread+0x10c/0x1b0\n kthread+0xc8/0xd8\n ret_from_fork+0x10/0x20\n\nThis issue has not been identified earlier because tests were done on\na device with SMP disabled and so spinlocks were actually NOPs.\n\nNow use spin_(un)lock_bh for TX queue related locking to avoid execution\nof softirq work synchronously that would lead to a deadlock." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:N - The deadlock is driven by TX saturation of the ks8851 Ethernet interface, which any remote peer can induce by sending traffic that the device must answer (ICMP echo, TCP responses from an exposed service); such traffic is routable and not confined to the local L2 segment.\nAC:L - The attacker fully controls the required precondition (TX queue congestion) and can replay the vulnerable stop/wake cycle thousands of times per second across two separate BH-enabled statelock windows (ks8851_irq and ks8851_tx_work), so the interrupt-arrival window is hit reliably under sustained load — as observed in practice by the reporter.\nPR:N - There is no authentication or capability check anywhere on the path; the trigger is ordinary qdisc transmit activity, and a remote unauthenticated attacker only needs to elicit packets from the device (e.g. ICMP echo replies).\nUI:N - No victim action is required; the deadlock arises purely from attacker-generated network load against a configured, running interface.\nS:U - The recursive spinlock acquisition hangs the CPU within the kernel's own security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:N - The bug is a lock-recursion deadlock with no out-of-bounds access, uninitialized data use, or memory corruption, so no information is disclosed.\nI:N - No memory is corrupted and no data is modified; the CPU simply spins forever on an already-held spinlock, offering no write or control-flow primitive.\nA:H - The affected CPU spins permanently in queued_spin_lock_slowpath with preemption disabled, producing a soft lockup, a permanently dead network interface, and on the single- or few-core embedded systems that use this SPI NIC a full system hang requiring a watchdog reset." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/net/ethernet/micrel/ks8851_common.c", "drivers/net/ethernet/micrel/ks8851_spi.c" ], "versions": [ { "version": "1092525155eaad5c69ca9f3b6f3e7895a9424d66", "lessThan": "a0c69c492f4a8fad52f0a97565241c926160c9a4", "status": "affected", "versionType": "git" }, { "version": "30302b41ffdcd194bef27fb3b1a9f2ca53dedb27", "lessThan": "80ece00137300d74642f2038c8fe5440deaf9f05", "status": "affected", "versionType": "git" }, { "version": "3dc5d44545453de1de9c53cc529cc960a85933da", "lessThan": "10fec0cd0e8f56ff06c46bb24254c7d8f8f2bbf0", "status": "affected", "versionType": "git" }, { "version": "3dc5d44545453de1de9c53cc529cc960a85933da", "lessThan": "0913ec336a6c0c4a2b296bd9f74f8e41c4c83c8c", "status": "affected", "versionType": "git" }, { "version": "786788bb1396ed5ea27e39c4933f59f4e52004e4", "status": "affected", "versionType": "git" }, { "version": "7c25c5d7274631b655f0f9098a16241fcd5db57b", "status": "affected", "versionType": "git" }, { "version": "6.1.70", "lessThan": "6.1.100", "status": "affected", "versionType": "semver" }, { "version": "6.6.9", "lessThan": "6.6.41", "status": "affected", "versionType": "semver" }, { "version": "5.10.206", "lessThan": "5.11", "status": "affected", "versionType": "semver" }, { "version": "5.15.146", "lessThan": "5.16", "status": "affected", "versionType": "semver" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/net/ethernet/micrel/ks8851_common.c", "drivers/net/ethernet/micrel/ks8851_spi.c" ], "versions": [ { "version": "6.7", "status": "affected" }, { "version": "0", "lessThan": "6.7", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.100", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.41", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.9.10", "lessThanOrEqual": "6.9.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.10", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1.70", "versionEndExcluding": "6.1.100" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6.9", "versionEndExcluding": "6.6.41" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.7", "versionEndExcluding": "6.9.10" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.7", "versionEndExcluding": "6.10" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10.206" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15.146" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/a0c69c492f4a8fad52f0a97565241c926160c9a4" }, { "url": "https://git.kernel.org/stable/c/80ece00137300d74642f2038c8fe5440deaf9f05" }, { "url": "https://git.kernel.org/stable/c/10fec0cd0e8f56ff06c46bb24254c7d8f8f2bbf0" }, { "url": "https://git.kernel.org/stable/c/0913ec336a6c0c4a2b296bd9f74f8e41c4c83c8c" } ], "title": "net: ks8851: Fix deadlock with the SPI chip variant", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "title": "CVE Program Container", "references": [ { "url": "https://git.kernel.org/stable/c/a0c69c492f4a8fad52f0a97565241c926160c9a4", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/80ece00137300d74642f2038c8fe5440deaf9f05", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/10fec0cd0e8f56ff06c46bb24254c7d8f8f2bbf0", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/0913ec336a6c0c4a2b296bd9f74f8e41c4c83c8c", "tags": [ "x_transferred" ] }, { "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html" } ], "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T21:59:33.670Z" } }, { "metrics": [ { "other": { "type": "ssvc", "content": { "id": "CVE-2024-41036", "role": "CISA Coordinator", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "version": "2.0.3", "timestamp": "2024-09-10T16:23:30.114712Z" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T17:34:03.463Z" } } ] } }