CVE-2024-43866 net/mlx5: Always drain health in shutdown callback
A race condition in the mlx5 network driver during device shutdown can lead to a NULL pointer dereference, causing a system crash.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-43866?
CVE-2024-43866 is a medium-severity vulnerability in Linux kernel, published on 20 Aug 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
net/mlx5: Always drain health in shutdown callback
There is no point in recovery during device shutdown. if health work started need to wait for it to avoid races and NULL pointer access.
Hence, drain health WQ on shutdown callback.
Which versions are affected by CVE-2024-43866?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2024-43866?
Apply the vendor's patch.
Is CVE-2024-43866 being exploited?
There is no known exploitation of CVE-2024-43866 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-56163, BELL-CVE-2024-43866, DEBIAN-CVE-2024-43866, GHSA-3xr6-pm2j-p9qj, ROOT-OS-DEBIAN-11-CVE-2024-43866, ROOT-OS-UBUNTU-2204-CVE-2024-43866 and 1 more.