Critical Vulnerability in Linux Kernel: TX Queue Reset Issue
Summary
DEBIAN-CVE-2024-56674: In the Linux kernel, the following vulnerability has been resolved: virtio_net: correct netdev_tx_reset_queue() invocation point When virtnet_close is followed by virtnet_open, some TX completions can possibly remain unc... Affects linux versions < 6.12.6-1. Fixed in 6.12.6-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware management and system processes. It is known for its robustness and flexibility, supporting a wide range of hardware architectures. However, vulnerabilities can arise, impacting system stability and security. This particular vulnerability affects the 'linux' package in Debian versions 13 and 14, which are widely used in various distributions.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified related to the virtio_net driver, specifically concerning the invocation point of netdev_tx_reset_queue(). When the virtnet_close function is followed by virtnet_open, some transmit (TX) completions may remain unprocessed, leading to potential crashes under heavy network load. This issue stems from an insufficient fix in a previous commit, which did not address all cases of BQL (Bandwidth Queue Limits) crashes for virtio-net. The vulnerability can be exploited by running a specific command that rapidly toggles the network device state, resulting in a kernel bug and system instability.
How To Fix
Minimum fixed version
6.12.6-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid the issue by not rapidly toggling the network device state. Instead of using the command 'while :; do ip l set DEV down; ip l set DEV up; done', consider managing the network device state manually and avoiding heavy TX loads during transitions.
Conclusion
The identified vulnerability in the Linux kernel related to the virtio_net driver poses a significant risk of system crashes under specific conditions. Users are advised to update their systems to the patched version to ensure stability and security. Temporary workarounds can help mitigate the issue until a full update can be applied.
See every vulnerability recorded for linux →
FAQ
The vulnerability can lead to system crashes and instability when the network device is rapidly toggled under heavy load.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without signup.
Debian versions 13 and 14 are affected by this vulnerability in the 'linux' package.
Yes, updating to the patched version 6.12.6-1 or later will resolve the vulnerability.
If you cannot update immediately, avoid rapidly toggling the network device state to mitigate the risk of crashes.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
