CVE-2024-42110 (GCVE-0-2024-42110)

Vulnerability from cvelistv5 – Published: 2024-07-30 07:46 – Updated: 2026-08-05 11:35
VLAI
Title
net: ntb_netdev: Move ntb_netdev_rx_handler() to call netif_rx() from __netif_rx()
Summary
In the Linux kernel, the following vulnerability has been resolved: net: ntb_netdev: Move ntb_netdev_rx_handler() to call netif_rx() from __netif_rx() The following is emitted when using idxd (DSA) dmanegine as the data mover for ntb_transport that ntb_netdev uses. [74412.546922] BUG: using smp_processor_id() in preemptible [00000000] code: irq/52-idxd-por/14526 [74412.556784] caller is netif_rx_internal+0x42/0x130 [74412.562282] CPU: 6 PID: 14526 Comm: irq/52-idxd-por Not tainted 6.9.5 #5 [74412.569870] Hardware name: Intel Corporation ArcherCity/ArcherCity, BIOS EGSDCRB1.E9I.1752.P05.2402080856 02/08/2024 [74412.581699] Call Trace: [74412.584514] <TASK> [74412.586933] dump_stack_lvl+0x55/0x70 [74412.591129] check_preemption_disabled+0xc8/0xf0 [74412.596374] netif_rx_internal+0x42/0x130 [74412.600957] __netif_rx+0x20/0xd0 [74412.604743] ntb_netdev_rx_handler+0x66/0x150 [ntb_netdev] [74412.610985] ntb_complete_rxc+0xed/0x140 [ntb_transport] [74412.617010] ntb_rx_copy_callback+0x53/0x80 [ntb_transport] [74412.623332] idxd_dma_complete_txd+0xe3/0x160 [idxd] [74412.628963] idxd_wq_thread+0x1a6/0x2b0 [idxd] [74412.634046] irq_thread_fn+0x21/0x60 [74412.638134] ? irq_thread+0xa8/0x290 [74412.642218] irq_thread+0x1a0/0x290 [74412.646212] ? __pfx_irq_thread_fn+0x10/0x10 [74412.651071] ? __pfx_irq_thread_dtor+0x10/0x10 [74412.656117] ? __pfx_irq_thread+0x10/0x10 [74412.660686] kthread+0x100/0x130 [74412.664384] ? __pfx_kthread+0x10/0x10 [74412.668639] ret_from_fork+0x31/0x50 [74412.672716] ? __pfx_kthread+0x10/0x10 [74412.676978] ret_from_fork_asm+0x1a/0x30 [74412.681457] </TASK> The cause is due to the idxd driver interrupt completion handler uses threaded interrupt and the threaded handler is not hard or soft interrupt context. However __netif_rx() can only be called from interrupt context. Change the call to netif_rx() in order to allow completion via normal context for dmaengine drivers that utilize threaded irq handling. While the following commit changed from netif_rx() to __netif_rx(), baebdf48c360 ("net: dev: Makes sure netif_rx() can be invoked in any context."), the change should've been a noop instead. However, the code precedes this fix should've been using netif_rx_ni() or netif_rx_any_context().
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-09-10 16:17 UTC
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 548c237c0a9972df5d1afaca38aa733ee577128d , < 4b3b6c7efee69f077b86ef7f088fb96768e46e1f (git)
Affected: 548c237c0a9972df5d1afaca38aa733ee577128d , < e3af5b14e7632bf12058533d69055393e2d126c9 (git)
Affected: 548c237c0a9972df5d1afaca38aa733ee577128d , < 858ae09f03677a4ab907a15516893bc2cc79d4c3 (git)
Affected: 548c237c0a9972df5d1afaca38aa733ee577128d , < e15a5d821e5192a3769d846079bc9aa380139baf (git)
Create a notification for this product.
Linux Linux Affected: 3.9
Unaffected: 0 , < 3.9 (semver)
Unaffected: 6.1.98 , ≤ 6.1.* (semver)
Unaffected: 6.6.39 , ≤ 6.6.* (semver)
Unaffected: 6.9.9 , ≤ 6.9.* (semver)
Unaffected: 6.10 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T22:01:45.573Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/4b3b6c7efee69f077b86ef7f088fb96768e46e1f"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/e3af5b14e7632bf12058533d69055393e2d126c9"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/858ae09f03677a4ab907a15516893bc2cc79d4c3"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/e15a5d821e5192a3769d846079bc9aa380139baf"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-42110",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T16:17:32.906742Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:33:06.779Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ntb_netdev.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "4b3b6c7efee69f077b86ef7f088fb96768e46e1f",
              "status": "affected",
              "version": "548c237c0a9972df5d1afaca38aa733ee577128d",
              "versionType": "git"
            },
            {
              "lessThan": "e3af5b14e7632bf12058533d69055393e2d126c9",
              "status": "affected",
              "version": "548c237c0a9972df5d1afaca38aa733ee577128d",
              "versionType": "git"
            },
            {
              "lessThan": "858ae09f03677a4ab907a15516893bc2cc79d4c3",
              "status": "affected",
              "version": "548c237c0a9972df5d1afaca38aa733ee577128d",
              "versionType": "git"
            },
            {
              "lessThan": "e15a5d821e5192a3769d846079bc9aa380139baf",
              "status": "affected",
              "version": "548c237c0a9972df5d1afaca38aa733ee577128d",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ntb_netdev.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.9"
            },
            {
              "lessThan": "3.9",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.98",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.39",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.9.*",
              "status": "unaffected",
              "version": "6.9.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.10",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.98",
                  "versionStartIncluding": "3.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.39",
                  "versionStartIncluding": "3.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9.9",
                  "versionStartIncluding": "3.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10",
                  "versionStartIncluding": "3.9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ntb_netdev: Move ntb_netdev_rx_handler() to call netif_rx() from __netif_rx()\n\nThe following is emitted when using idxd (DSA) dmanegine as the data\nmover for ntb_transport that ntb_netdev uses.\n\n[74412.546922] BUG: using smp_processor_id() in preemptible [00000000] code: irq/52-idxd-por/14526\n[74412.556784] caller is netif_rx_internal+0x42/0x130\n[74412.562282] CPU: 6 PID: 14526 Comm: irq/52-idxd-por Not tainted 6.9.5 #5\n[74412.569870] Hardware name: Intel Corporation ArcherCity/ArcherCity, BIOS EGSDCRB1.E9I.1752.P05.2402080856 02/08/2024\n[74412.581699] Call Trace:\n[74412.584514]  \u003cTASK\u003e\n[74412.586933]  dump_stack_lvl+0x55/0x70\n[74412.591129]  check_preemption_disabled+0xc8/0xf0\n[74412.596374]  netif_rx_internal+0x42/0x130\n[74412.600957]  __netif_rx+0x20/0xd0\n[74412.604743]  ntb_netdev_rx_handler+0x66/0x150 [ntb_netdev]\n[74412.610985]  ntb_complete_rxc+0xed/0x140 [ntb_transport]\n[74412.617010]  ntb_rx_copy_callback+0x53/0x80 [ntb_transport]\n[74412.623332]  idxd_dma_complete_txd+0xe3/0x160 [idxd]\n[74412.628963]  idxd_wq_thread+0x1a6/0x2b0 [idxd]\n[74412.634046]  irq_thread_fn+0x21/0x60\n[74412.638134]  ? irq_thread+0xa8/0x290\n[74412.642218]  irq_thread+0x1a0/0x290\n[74412.646212]  ? __pfx_irq_thread_fn+0x10/0x10\n[74412.651071]  ? __pfx_irq_thread_dtor+0x10/0x10\n[74412.656117]  ? __pfx_irq_thread+0x10/0x10\n[74412.660686]  kthread+0x100/0x130\n[74412.664384]  ? __pfx_kthread+0x10/0x10\n[74412.668639]  ret_from_fork+0x31/0x50\n[74412.672716]  ? __pfx_kthread+0x10/0x10\n[74412.676978]  ret_from_fork_asm+0x1a/0x30\n[74412.681457]  \u003c/TASK\u003e\n\nThe cause is due to the idxd driver interrupt completion handler uses\nthreaded interrupt and the threaded handler is not hard or soft interrupt\ncontext. However __netif_rx() can only be called from interrupt context.\nChange the call to netif_rx() in order to allow completion via normal\ncontext for dmaengine drivers that utilize threaded irq handling.\n\nWhile the following commit changed from netif_rx() to __netif_rx(),\nbaebdf48c360 (\"net: dev: Makes sure netif_rx() can be invoked in any context.\"),\nthe change should\u0027ve been a noop instead. However, the code precedes this\nfix should\u0027ve been using netif_rx_ni() or netif_rx_any_context()."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The vulnerable code is a network receive handler bound to the kernel network stack; it runs on every frame arriving on the ntb_netdev Ethernet interface, with the payload supplied by a remote peer over the NTB interconnect. In the dual-controller storage and cluster deployments NTB exists for, that interconnect carries routed/bridged IP traffic, so packets originating more than one hop away reach `ntb_netdev_rx_handler()` and no local access to the target is needed.\nAC:L - Scored in the vulnerable configuration (`ntb_transport use_dma=1` with a threaded-completion dmaengine such as idxd/DSA, exactly what the report documents), every frame at or above the default `copy_bytes=1024` threshold takes `ntb_async_rx()` and completes in the preemptible `idxd_wq_thread` IRQ kthread, so ordinary MTU-sized traffic hits `__netif_rx()` in preemptible context 100% of the time. There is no race to win, no timing window, and no memory-layout precondition \u2014 the attacker sets the rate and the frame size.\nPR:N - The path is raw Ethernet frame reception \u2014 `eth_type_trans()` and `__netif_rx()` run before any protocol, socket, or application-layer authentication, and nothing on the path calls `capable()` or checks credentials. The attacker needs no account, session, or key on the target.\nUI:N - The attacker generates the frames and the NTB doorbell, tasklet, DMA submission, and idxd completion thread all run autonomously as part of normal interface operation. No administrator or second user has to log in, mount, open, or configure anything.\nS:U - The preemption violation, the deferred softirq, and any resulting backlog corruption or panic all occur inside the kernel that owns the ntb_netdev interface and the per-CPU `softnet_data`; no VM, hypervisor, IOMMU, or sandbox boundary is crossed.\nC:N - There is no out-of-bounds read, use-after-free, or uninitialized-memory disclosure \u2014 `enqueue_to_backlog()` is passed a valid `struct softnet_data` and the skb is a properly sized, driver-allocated buffer. The only artifact is the rate-limited `BUG:`/`dump_stack()` in dmesg, which prints symbol+offset rather than raw addresses and is not observable by the packet-sending attacker at all.\nI:N - On any realistic affected system `CONFIG_RPS` is set (`default y`, disabled only when `SMP=n`, which removes the race, or `SYSFS=n`, absent on the x86 servers NTB ships on), so `backlog_lock_irq_save()` takes `spin_lock_irqsave(\u0026sd-\u003einput_pkt_queue.lock)` and every cross-CPU backlog access stays properly serialized. Packets themselves are delivered unmodified \u2014 merely late \u2014 and no attacker-controlled data lands in unintended kernel memory.\nA:H - `__netif_rx()`\u0027s `lockdep_assert_once(hardirq_count() | softirq_count())` is a `WARN_ON_ONCE`, so on `CONFIG_PROVE_LOCKING` kernels booted with `panic_on_warn=1` \u2014 standard for fail-fast storage appliances and CI fleets \u2014 the first frame panics the host outright. Even without that, `napi_schedule_rps()` only sets the `NET_RX_SOFTIRQ` pending bit and nothing drains it (the fix\u0027s `local_bh_enable()` is precisely what restores that), so under sustained peer traffic the backlog exceeds `netdev_max_backlog` and packets are discarded in `cpu_backlog_drop`, stalling the node interconnect; and on SMP builds where `CONFIG_RPS` is off, the bare `local_irq_save()` leaves a migrated thread corrupting a remote CPU\u0027s `input_pkt_queue` and `backlog.state`, producing skb list corruption and an oops."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:35:42.204Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/4b3b6c7efee69f077b86ef7f088fb96768e46e1f"
        },
        {
          "url": "https://git.kernel.org/stable/c/e3af5b14e7632bf12058533d69055393e2d126c9"
        },
        {
          "url": "https://git.kernel.org/stable/c/858ae09f03677a4ab907a15516893bc2cc79d4c3"
        },
        {
          "url": "https://git.kernel.org/stable/c/e15a5d821e5192a3769d846079bc9aa380139baf"
        }
      ],
      "title": "net: ntb_netdev: Move ntb_netdev_rx_handler() to call netif_rx() from __netif_rx()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-42110",
    "datePublished": "2024-07-30T07:46:04.892Z",
    "dateReserved": "2024-07-29T15:50:41.176Z",
    "dateUpdated": "2026-08-05T11:35:42.204Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-42110",
      "date": "2026-08-16",
      "epss": "0.00646",
      "percentile": "0.48015"
    },
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet: ntb_netdev: Move ntb_netdev_rx_handler() to call netif_rx() from __netif_rx()\\n\\nThe following is emitted when using idxd (DSA) dmanegine as the data\\nmover for ntb_transport that ntb_netdev uses.\\n\\n[74412.546922] BUG: using smp_processor_id() in preemptible [00000000] code: irq/52-idxd-por/14526\\n[74412.556784] caller is netif_rx_internal+0x42/0x130\\n[74412.562282] CPU: 6 PID: 14526 Comm: irq/52-idxd-por Not tainted 6.9.5 #5\\n[74412.569870] Hardware name: Intel Corporation ArcherCity/ArcherCity, BIOS EGSDCRB1.E9I.1752.P05.2402080856 02/08/2024\\n[74412.581699] Call Trace:\\n[74412.584514]  \u003cTASK\u003e\\n[74412.586933]  dump_stack_lvl+0x55/0x70\\n[74412.591129]  check_preemption_disabled+0xc8/0xf0\\n[74412.596374]  netif_rx_internal+0x42/0x130\\n[74412.600957]  __netif_rx+0x20/0xd0\\n[74412.604743]  ntb_netdev_rx_handler+0x66/0x150 [ntb_netdev]\\n[74412.610985]  ntb_complete_rxc+0xed/0x140 [ntb_transport]\\n[74412.617010]  ntb_rx_copy_callback+0x53/0x80 [ntb_transport]\\n[74412.623332]  idxd_dma_complete_txd+0xe3/0x160 [idxd]\\n[74412.628963]  idxd_wq_thread+0x1a6/0x2b0 [idxd]\\n[74412.634046]  irq_thread_fn+0x21/0x60\\n[74412.638134]  ? irq_thread+0xa8/0x290\\n[74412.642218]  irq_thread+0x1a0/0x290\\n[74412.646212]  ? __pfx_irq_thread_fn+0x10/0x10\\n[74412.651071]  ? __pfx_irq_thread_dtor+0x10/0x10\\n[74412.656117]  ? __pfx_irq_thread+0x10/0x10\\n[74412.660686]  kthread+0x100/0x130\\n[74412.664384]  ? __pfx_kthread+0x10/0x10\\n[74412.668639]  ret_from_fork+0x31/0x50\\n[74412.672716]  ? __pfx_kthread+0x10/0x10\\n[74412.676978]  ret_from_fork_asm+0x1a/0x30\\n[74412.681457]  \u003c/TASK\u003e\\n\\nThe cause is due to the idxd driver interrupt completion handler uses\\nthreaded interrupt and the threaded handler is not hard or soft interrupt\\ncontext. However __netif_rx() can only be called from interrupt context.\\nChange the call to netif_rx() in order to allow completion via normal\\ncontext for dmaengine drivers that utilize threaded irq handling.\\n\\nWhile the following commit changed from netif_rx() to __netif_rx(),\\nbaebdf48c360 (\\\"net: dev: Makes sure netif_rx() can be invoked in any context.\\\"),\\nthe change should\u0027ve been a noop instead. However, the code precedes this\\nfix should\u0027ve been using netif_rx_ni() or netif_rx_any_context().\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net: ntb_netdev: Mover ntb_netdev_rx_handler() para llamar a netif_rx() desde __netif_rx() Lo siguiente se emite cuando se utiliza idxd (DSA) dmanegine como transportador de datos para ntb_transport que utiliza ntb_netdev. [74412.546922] ERROR: usar smp_processor_id() en c\\u00f3digo interrumpible [00000000]: irq/52-idxd-por/14526 [74412.556784] la persona que llama es netif_rx_internal+0x42/0x130 [74412.562282] CPU: 6 PID: 6 Comunicaciones: irq/52- idxd-por No contaminado 6.9.5 #5 [74412.569870] Nombre de hardware: Intel Corporation ArcherCity/ArcherCity, BIOS EGSDCRB1.E9I.1752.P05.2402080856 08/02/2024 [74412.581699] Seguimiento de llamadas: [74412.584514] [ 74412.586933] dump_stack_lvl+0x55/0x70 [74412.591129] check_preemption_disabled+0xc8/0xf0 [74412.596374] netif_rx_internal+0x42/0x130 [74412.600957] 0/0xd0 [74412.604743] ntb_netdev_rx_handler+0x66/0x150 [ntb_netdev] [74412.610985] ntb_complete_rxc+0xed/0x140 [ntb_transport] [74412.617010] ntb_rx_copy_callback+0x53/0x80 [ntb_transport] [74412.623332] idxd_dma_complete_txd+0xe3/0x160 [idxd] [74412.628963] idxd_wq_thread+0x1a6/0x 2b0 [idxd] [74412.634046] irq_thread_fn+0x21/0x60 [74412.638134] ? hilo_irq+0xa8/0x290 [74412.642218] hilo_irq+0x1a0/0x290 [74412.646212] ? __pfx_irq_thread_fn+0x10/0x10 [74412.651071] ? __pfx_irq_thread_dtor+0x10/0x10 [74412.656117] ? __pfx_irq_thread+0x10/0x10 [74412.660686] kthread+0x100/0x130 [74412.664384] ? __pfx_kthread+0x10/0x10 [74412.668639] ret_from_fork+0x31/0x50 [74412.672716] ? __pfx_kthread+0x10/0x10 [74412.676978] ret_from_fork_asm+0x1a/0x30 [74412.681457]  La causa se debe a que el controlador de finalizaci\\u00f3n de interrupciones del controlador idxd utiliza interrupciones de subprocesos y el controlador de subprocesos no es un contexto de interrupci\\u00f3n dura o suave. Sin embargo, __netif_rx() solo se puede llamar desde el contexto de interrupci\\u00f3n. Cambie la llamada a netif_rx() para permitir la finalizaci\\u00f3n a trav\\u00e9s del contexto normal para los controladores dmaengine que utilizan el manejo de irq por subprocesos. Si bien la siguiente confirmaci\\u00f3n cambi\\u00f3 de netif_rx() a __netif_rx(), baebdf48c360 (\\\"net: dev: se asegura de que netif_rx() pueda invocarse en cualquier contexto.\\\"), el cambio deber\\u00eda haber sido un fracaso. Sin embargo, el c\\u00f3digo que precede a esta soluci\\u00f3n deber\\u00eda haber usado netif_rx_ni() o netif_rx_any_context().\"}]",
      "id": "CVE-2024-42110",
      "lastModified": "2024-11-21T09:33:37.363",
      "published": "2024-07-30T08:15:03.487",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/4b3b6c7efee69f077b86ef7f088fb96768e46e1f\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/858ae09f03677a4ab907a15516893bc2cc79d4c3\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/e15a5d821e5192a3769d846079bc9aa380139baf\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/e3af5b14e7632bf12058533d69055393e2d126c9\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/4b3b6c7efee69f077b86ef7f088fb96768e46e1f\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/858ae09f03677a4ab907a15516893bc2cc79d4c3\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/e15a5d821e5192a3769d846079bc9aa380139baf\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/e3af5b14e7632bf12058533d69055393e2d126c9\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Awaiting Analysis"
    },
    "microsoft_vex": {
      "current_release_date": "2025-10-10T14:35:18.000Z",
      "cve": "CVE-2024-42110",
      "id": "msrc_CVE-2024-42110",
      "initial_release_date": "2024-07-01T07:00:00.000Z",
      "product_status:known_not_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "net: ntb_netdev: Move ntb_netdev_rx_handler() to call netif_rx() from __netif_rx()",
      "url": "https://msrc.microsoft.com/csaf/vex/2024/msrc_cve-2024-42110.json",
      "version": "1"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-42110\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-07-30T08:15:03.487\",\"lastModified\":\"2026-08-04T11:19:35.260\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet: ntb_netdev: Move ntb_netdev_rx_handler() to call netif_rx() from __netif_rx()\\n\\nThe following is emitted when using idxd (DSA) dmanegine as the data\\nmover for ntb_transport that ntb_netdev uses.\\n\\n[74412.546922] BUG: using smp_processor_id() in preemptible [00000000] code: irq/52-idxd-por/14526\\n[74412.556784] caller is netif_rx_internal+0x42/0x130\\n[74412.562282] CPU: 6 PID: 14526 Comm: irq/52-idxd-por Not tainted 6.9.5 #5\\n[74412.569870] Hardware name: Intel Corporation ArcherCity/ArcherCity, BIOS EGSDCRB1.E9I.1752.P05.2402080856 02/08/2024\\n[74412.581699] Call Trace:\\n[74412.584514]  \u003cTASK\u003e\\n[74412.586933]  dump_stack_lvl+0x55/0x70\\n[74412.591129]  check_preemption_disabled+0xc8/0xf0\\n[74412.596374]  netif_rx_internal+0x42/0x130\\n[74412.600957]  __netif_rx+0x20/0xd0\\n[74412.604743]  ntb_netdev_rx_handler+0x66/0x150 [ntb_netdev]\\n[74412.610985]  ntb_complete_rxc+0xed/0x140 [ntb_transport]\\n[74412.617010]  ntb_rx_copy_callback+0x53/0x80 [ntb_transport]\\n[74412.623332]  idxd_dma_complete_txd+0xe3/0x160 [idxd]\\n[74412.628963]  idxd_wq_thread+0x1a6/0x2b0 [idxd]\\n[74412.634046]  irq_thread_fn+0x21/0x60\\n[74412.638134]  ? irq_thread+0xa8/0x290\\n[74412.642218]  irq_thread+0x1a0/0x290\\n[74412.646212]  ? __pfx_irq_thread_fn+0x10/0x10\\n[74412.651071]  ? __pfx_irq_thread_dtor+0x10/0x10\\n[74412.656117]  ? __pfx_irq_thread+0x10/0x10\\n[74412.660686]  kthread+0x100/0x130\\n[74412.664384]  ? __pfx_kthread+0x10/0x10\\n[74412.668639]  ret_from_fork+0x31/0x50\\n[74412.672716]  ? __pfx_kthread+0x10/0x10\\n[74412.676978]  ret_from_fork_asm+0x1a/0x30\\n[74412.681457]  \u003c/TASK\u003e\\n\\nThe cause is due to the idxd driver interrupt completion handler uses\\nthreaded interrupt and the threaded handler is not hard or soft interrupt\\ncontext. However __netif_rx() can only be called from interrupt context.\\nChange the call to netif_rx() in order to allow completion via normal\\ncontext for dmaengine drivers that utilize threaded irq handling.\\n\\nWhile the following commit changed from netif_rx() to __netif_rx(),\\nbaebdf48c360 (\\\"net: dev: Makes sure netif_rx() can be invoked in any context.\\\"),\\nthe change should\u0027ve been a noop instead. However, the code precedes this\\nfix should\u0027ve been using netif_rx_ni() or netif_rx_any_context().\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net: ntb_netdev: Mover ntb_netdev_rx_handler() para llamar a netif_rx() desde __netif_rx() Lo siguiente se emite cuando se utiliza idxd (DSA) dmanegine como transportador de datos para ntb_transport que utiliza ntb_netdev. [74412.546922] ERROR: usar smp_processor_id() en c\u00f3digo interrumpible [00000000]: irq/52-idxd-por/14526 [74412.556784] la persona que llama es netif_rx_internal+0x42/0x130 [74412.562282] CPU: 6 PID: 6 Comunicaciones: irq/52- idxd-por No contaminado 6.9.5 #5 [74412.569870] Nombre de hardware: Intel Corporation ArcherCity/ArcherCity, BIOS EGSDCRB1.E9I.1752.P05.2402080856 08/02/2024 [74412.581699] Seguimiento de llamadas: [74412.584514] [ 74412.586933] dump_stack_lvl+0x55/0x70 [74412.591129] check_preemption_disabled+0xc8/0xf0 [74412.596374] netif_rx_internal+0x42/0x130 [74412.600957] 0/0xd0 [74412.604743] ntb_netdev_rx_handler+0x66/0x150 [ntb_netdev] [74412.610985] ntb_complete_rxc+0xed/0x140 [ntb_transport] [74412.617010] ntb_rx_copy_callback+0x53/0x80 [ntb_transport] [74412.623332] idxd_dma_complete_txd+0xe3/0x160 [idxd] [74412.628963] idxd_wq_thread+0x1a6/0x 2b0 [idxd] [74412.634046] irq_thread_fn+0x21/0x60 [74412.638134] ? hilo_irq+0xa8/0x290 [74412.642218] hilo_irq+0x1a0/0x290 [74412.646212] ? __pfx_irq_thread_fn+0x10/0x10 [74412.651071] ? __pfx_irq_thread_dtor+0x10/0x10 [74412.656117] ? __pfx_irq_thread+0x10/0x10 [74412.660686] kthread+0x100/0x130 [74412.664384] ? __pfx_kthread+0x10/0x10 [74412.668639] ret_from_fork+0x31/0x50 [74412.672716] ? __pfx_kthread+0x10/0x10 [74412.676978] ret_from_fork_asm+0x1a/0x30 [74412.681457]  La causa se debe a que el controlador de finalizaci\u00f3n de interrupciones del controlador idxd utiliza interrupciones de subprocesos y el controlador de subprocesos no es un contexto de interrupci\u00f3n dura o suave. Sin embargo, __netif_rx() solo se puede llamar desde el contexto de interrupci\u00f3n. Cambie la llamada a netif_rx() para permitir la finalizaci\u00f3n a trav\u00e9s del contexto normal para los controladores dmaengine que utilizan el manejo de irq por subprocesos. Si bien la siguiente confirmaci\u00f3n cambi\u00f3 de netif_rx() a __netif_rx(), baebdf48c360 (\\\"net: dev: se asegura de que netif_rx() pueda invocarse en cualquier contexto.\\\"), el cambio deber\u00eda haber sido un fracaso. Sin embargo, el c\u00f3digo que precede a esta soluci\u00f3n deber\u00eda haber usado netif_rx_ni() o netif_rx_any_context().\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/net/ntb_netdev.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"548c237c0a9972df5d1afaca38aa733ee577128d\",\"lessThan\":\"4b3b6c7efee69f077b86ef7f088fb96768e46e1f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"548c237c0a9972df5d1afaca38aa733ee577128d\",\"lessThan\":\"e3af5b14e7632bf12058533d69055393e2d126c9\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"548c237c0a9972df5d1afaca38aa733ee577128d\",\"lessThan\":\"858ae09f03677a4ab907a15516893bc2cc79d4c3\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"548c237c0a9972df5d1afaca38aa733ee577128d\",\"lessThan\":\"e15a5d821e5192a3769d846079bc9aa380139baf\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/net/ntb_netdev.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"3.9\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"3.9\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.98\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.39\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.9.9\",\"lessThanOrEqual\":\"6.9.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.10\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-09-10T16:17:32.906742Z\",\"id\":\"CVE-2024-42110\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.9\",\"versionEndExcluding\":\"6.1.98\",\"matchCriteriaId\":\"7B5215F1-790C-4059-943A-D43BD397DD9C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.39\",\"matchCriteriaId\":\"29E894E4-668F-4DB0-81F7-4FB5F698E970\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.9.9\",\"matchCriteriaId\":\"ADCC1407-0CB3-4C8F-B4C5-07F682CD7085\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.10:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"2EBB4392-5FA6-4DA9-9772-8F9C750109FA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.10:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"331C2F14-12C7-45D5-893D-8C52EE38EA10\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.10:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"3173713D-909A-4DD3-9DD4-1E171EB057EE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.10:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"79F18AFA-40F7-43F0-BA30-7BDB65F918B9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.10:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"BD973AA4-A789-49BD-8D57-B2846935D3C7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.10:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"8F3E9E0C-AC3E-4967-AF80-6483E8AB0078\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/4b3b6c7efee69f077b86ef7f088fb96768e46e1f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/858ae09f03677a4ab907a15516893bc2cc79d4c3\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e15a5d821e5192a3769d846079bc9aa380139baf\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e3af5b14e7632bf12058533d69055393e2d126c9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/4b3b6c7efee69f077b86ef7f088fb96768e46e1f\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/858ae09f03677a4ab907a15516893bc2cc79d4c3\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e15a5d821e5192a3769d846079bc9aa380139baf\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e3af5b14e7632bf12058533d69055393e2d126c9\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-05T03:52:41+00:00",
      "cve": "CVE-2024-42110",
      "id": "CVE-2024-42110",
      "initial_release_date": "2024-07-30T00:00:00+00:00",
      "product_status:fixed": "279",
      "product_status:known_affected": "98",
      "product_status:known_not_affected": "14",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: net: ntb_netdev: Move ntb_netdev_rx_handler() to call netif_rx() from __netif_rx()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-42110.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-05T00:54:54Z",
      "cve": "CVE-2024-42110",
      "id": "CVE-2024-42110",
      "initial_release_date": "2024-08-06T01:59:53Z",
      "product_status:known_affected": "528",
      "product_status:known_not_affected": "6",
      "product_status:recommended": "761",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-42110",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-42110.json",
      "version": "67"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/4b3b6c7efee69f077b86ef7f088fb96768e46e1f\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/e3af5b14e7632bf12058533d69055393e2d126c9\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/858ae09f03677a4ab907a15516893bc2cc79d4c3\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/e15a5d821e5192a3769d846079bc9aa380139baf\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-11-03T22:01:45.573Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-42110\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-10T16:17:32.906742Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-11T12:42:14.585Z\"}}], \"cna\": {\"title\": \"net: ntb_netdev: Move ntb_netdev_rx_handler() to call netif_rx() from __netif_rx()\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"548c237c0a9972df5d1afaca38aa733ee577128d\", \"lessThan\": \"4b3b6c7efee69f077b86ef7f088fb96768e46e1f\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"548c237c0a9972df5d1afaca38aa733ee577128d\", \"lessThan\": \"e3af5b14e7632bf12058533d69055393e2d126c9\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"548c237c0a9972df5d1afaca38aa733ee577128d\", \"lessThan\": \"858ae09f03677a4ab907a15516893bc2cc79d4c3\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"548c237c0a9972df5d1afaca38aa733ee577128d\", \"lessThan\": \"e15a5d821e5192a3769d846079bc9aa380139baf\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/net/ntb_netdev.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"3.9\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"3.9\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.1.98\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.39\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.9.9\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.9.*\"}, {\"status\": \"unaffected\", \"version\": \"6.10\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/net/ntb_netdev.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/4b3b6c7efee69f077b86ef7f088fb96768e46e1f\"}, {\"url\": \"https://git.kernel.org/stable/c/e3af5b14e7632bf12058533d69055393e2d126c9\"}, {\"url\": \"https://git.kernel.org/stable/c/858ae09f03677a4ab907a15516893bc2cc79d4c3\"}, {\"url\": \"https://git.kernel.org/stable/c/e15a5d821e5192a3769d846079bc9aa380139baf\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet: ntb_netdev: Move ntb_netdev_rx_handler() to call netif_rx() from __netif_rx()\\n\\nThe following is emitted when using idxd (DSA) dmanegine as the data\\nmover for ntb_transport that ntb_netdev uses.\\n\\n[74412.546922] BUG: using smp_processor_id() in preemptible [00000000] code: irq/52-idxd-por/14526\\n[74412.556784] caller is netif_rx_internal+0x42/0x130\\n[74412.562282] CPU: 6 PID: 14526 Comm: irq/52-idxd-por Not tainted 6.9.5 #5\\n[74412.569870] Hardware name: Intel Corporation ArcherCity/ArcherCity, BIOS EGSDCRB1.E9I.1752.P05.2402080856 02/08/2024\\n[74412.581699] Call Trace:\\n[74412.584514]  \u003cTASK\u003e\\n[74412.586933]  dump_stack_lvl+0x55/0x70\\n[74412.591129]  check_preemption_disabled+0xc8/0xf0\\n[74412.596374]  netif_rx_internal+0x42/0x130\\n[74412.600957]  __netif_rx+0x20/0xd0\\n[74412.604743]  ntb_netdev_rx_handler+0x66/0x150 [ntb_netdev]\\n[74412.610985]  ntb_complete_rxc+0xed/0x140 [ntb_transport]\\n[74412.617010]  ntb_rx_copy_callback+0x53/0x80 [ntb_transport]\\n[74412.623332]  idxd_dma_complete_txd+0xe3/0x160 [idxd]\\n[74412.628963]  idxd_wq_thread+0x1a6/0x2b0 [idxd]\\n[74412.634046]  irq_thread_fn+0x21/0x60\\n[74412.638134]  ? irq_thread+0xa8/0x290\\n[74412.642218]  irq_thread+0x1a0/0x290\\n[74412.646212]  ? __pfx_irq_thread_fn+0x10/0x10\\n[74412.651071]  ? __pfx_irq_thread_dtor+0x10/0x10\\n[74412.656117]  ? __pfx_irq_thread+0x10/0x10\\n[74412.660686]  kthread+0x100/0x130\\n[74412.664384]  ? __pfx_kthread+0x10/0x10\\n[74412.668639]  ret_from_fork+0x31/0x50\\n[74412.672716]  ? __pfx_kthread+0x10/0x10\\n[74412.676978]  ret_from_fork_asm+0x1a/0x30\\n[74412.681457]  \u003c/TASK\u003e\\n\\nThe cause is due to the idxd driver interrupt completion handler uses\\nthreaded interrupt and the threaded handler is not hard or soft interrupt\\ncontext. However __netif_rx() can only be called from interrupt context.\\nChange the call to netif_rx() in order to allow completion via normal\\ncontext for dmaengine drivers that utilize threaded irq handling.\\n\\nWhile the following commit changed from netif_rx() to __netif_rx(),\\nbaebdf48c360 (\\\"net: dev: Makes sure netif_rx() can be invoked in any context.\\\"),\\nthe change should\u0027ve been a noop instead. However, the code precedes this\\nfix should\u0027ve been using netif_rx_ni() or netif_rx_any_context().\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.98\", \"versionStartIncluding\": \"3.9\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.39\", \"versionStartIncluding\": \"3.9\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.9.9\", \"versionStartIncluding\": \"3.9\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.10\", \"versionStartIncluding\": \"3.9\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-05-11T20:27:11.998Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-42110\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-05-11T20:27:11.998Z\", \"dateReserved\": \"2024-07-29T15:50:41.176Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-07-30T07:46:04.892Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.