CVE-2024-43834
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
In the Linux kernel, an invalid wait context issue exists in page_pool_destroy(). When a driver uses XDP and calls page_pool_destroy() followed by xdp_unreg_mem_model(), it attempts to acquire a mutex under RCU read lock, triggering an invalid wait context warning. The fix replaces rhashtable_lookup() with rcu_read_lock() with rhashtable_lookup_fast() without RCU lock.
Risk Assessment
This can lead to system instability, kernel warnings, and potentially hangs or crashes, especially on systems using network drivers with XDP and page pool (e.g., bnxt).
Recommendation
Update the Linux kernel to a version containing the fix for CVE-2024-43834. If updating is not possible, consider avoiding configurations that simultaneously trigger page_pool_destroy() and xdp_unreg_mem_model() in network drivers.
Other vulnerabilities in Linux kernel
See all- CVE-2026-99259Unknown
In the Linux kernel, the soc/tegra: pmc driver has an uninitialised early_pmc->rate variable for legacy 32-bit Tegra devices. The variable is never configured and remains 0, triggering a warning in tegra_pmc_enter_suspend_mode(). The issue appeared after the PMC driver was changed to create the PMC context dynamically, updating rate only in the new context.
- CVE-2026-99258Unknown
In the Linux kernel, hv_apicid_to_vp_index() uses per-CPU hypercall input and output pages. In an SEV-SNP CoCo VM without a paravisor the output page is not allocated, so the hypervisor stores the resulting VP index into memory not allocated by the guest. The fix uses the input page for both input and output.
- CVE-2026-99257Unknown
In the Linux kernel, the shared GPIO mechanism based on platform lookup tables requires an associated struct device. An fwnode-based lookup with no associated device currently causes a NULL-pointer dereference. The fix adds a check that lets the kernel gracefully handle this situation with an error.
- CVE-2026-99256Unknown
In the Linux kernel, the dm cache module used a rw_semaphore for background_work_lock, although write locks on rw_semaphores have strict owner semantics. The locking process was not always the same as the unlocking one, triggering a warning with CONFIG_DEBUG_RWSEMS during suspend/resume of a cache device. The fix replaces the rw_semaphore with a spinlock and a wait queue.
- CVE-2026-99251Unknown
In the Linux kernel, init_vp_index() contains a retry loop that strips CPUs from a node if they are already in the allocated cpumask or outside the HK_TYPE_MANAGED_IRQ housekeeping cpumask. If the housekeeping cpumask contains no CPU in that node, the loop becomes infinite. The fix skips NUMA nodes with no housekeeping CPU and aborts early when no online housekeeping CPUs exist.
- CVE-2026-99250Unknown
In the Linux kernel, the NBCON console printing kthreads are started very early during boot via early_initcall(). Asynchronously enabling/disabling interrupts during early boot may interfere with early SMP setup on some hardware platforms, causing hangs. The fix postpones kthread startup until after all arch initcalls have completed.
- CVE-2026-99249Unknown
In the Linux kernel, zap_pid_ns_processes() waiting for PID namespace cleanup was not freezable. A tracer outside the namespace that does not reap its traced zombies keeps PIDs allocated, making the wait unbounded and causing every suspend attempt to fail. The fix makes the wait loops use TASK_FREEZABLE states so the freezer can freeze waiting tasks.
- CVE-2026-99248Unknown
In the Linux kernel, the i2c: xiic driver was changed to restore non-managed runtime PM instead of the devres-based approach to fix a clk WARN flood. The managed release tore down runtime PM in the wrong order, causing the clock to be disabled twice and triggering "clkN already disabled" warnings on every teardown.
- CVE-2026-99247Unknown
In the Linux kernel, if trace buffer allocation fails during early boot, tracing_disabled remains set and the global trace array events list stays uninitialized. tracer_init_tracefs_work_func() runs asynchronously without checking this state and calls event_trace_init() and init_tracer_tracefs(), leading to a NULL pointer dereference Oops during boot. The fix checks tracing_disabled at the start of the work function.
- CVE-2026-99215Unknown
In the Linux kernel power supply subsystem, a use-after-free vulnerability exists. If a power supply is unregistered while its external_power_changed() callback is still running, the driver may free data that the callback is still accessing, leading to a kernel crash (NULL pointer dereference).
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: xdp: fix invalid wait context of page_pool_destroy() If the driver uses a page pool, it creates a page pool with page_pool_create(). The reference count of page pool is 1 as default. A page pool will be destroyed only when a reference count reaches 0. page_pool_destroy() is used to destroy page pool, it decreases a reference count. When a page pool is destroyed, ->disconnect() is called, which is mem_allocator_disconnect(). This function internally acquires mutex_lock(). If the driver uses XDP, it registers a memory model with xdp_rxq_info_reg_mem_model(). The xdp_rxq_info_reg_mem_model() internally increases a page pool reference count if a memory model is a page pool. Now the reference count is 2. To destroy a page pool, the driver should call both page_pool_destroy() and xdp_unreg_mem_model(). The xdp_unreg_mem_model() internally calls page_pool_destroy(). Only page_pool_destroy() decreases a reference count. If a driver calls page_pool_destroy() then xdp_unreg_mem_model(), we will face an invalid wait context warning. Because xdp_unreg_mem_model() calls page_pool_destroy() with rcu_read_lock(). The page_pool_destroy() internally acquires mutex_lock(). Splat looks like: ============================= [ BUG: Invalid wait context ] 6.10.0-rc6+ #4 Tainted: G W ----------------------------- ethtool/1806 is trying to lock: ffffffff90387b90 (mem_id_lock){+.+.}-{4:4}, at: mem_allocator_disconnect+0x73/0x150 other info that might help us debug this: context-{5:5} 3 locks held by ethtool/1806: stack backtrace: CPU: 0 PID: 1806 Comm: ethtool Tainted: G W 6.10.0-rc6+ #4 f916f41f172891c800f2fed Hardware name: ASUS System Product Name/PRIME Z690-P D4, BIOS 0603 11/01/2021 Call Trace: <TASK> dump_stack_lvl+0x7e/0xc0 __lock_acquire+0x1681/0x4de0 ? _printk+0x64/0xe0 ? __pfx_mark_lock.part.0+0x10/0x10 ? __pfx___lock_acquire+0x10/0x10 lock_acquire+0x1b3/0x580 ? mem_allocator_disconnect+0x73/0x150 ? __wake_up_klogd.part.0+0x16/0xc0 ? __pfx_lock_acquire+0x10/0x10 ? dump_stack_lvl+0x91/0xc0 __mutex_lock+0x15c/0x1690 ? mem_allocator_disconnect+0x73/0x150 ? __pfx_prb_read_valid+0x10/0x10 ? mem_allocator_disconnect+0x73/0x150 ? __pfx_llist_add_batch+0x10/0x10 ? console_unlock+0x193/0x1b0 ? lockdep_hardirqs_on+0xbe/0x140 ? __pfx___mutex_lock+0x10/0x10 ? tick_nohz_tick_stopped+0x16/0x90 ? __irq_work_queue_local+0x1e5/0x330 ? irq_work_queue+0x39/0x50 ? __wake_up_klogd.part.0+0x79/0xc0 ? mem_allocator_disconnect+0x73/0x150 mem_allocator_disconnect+0x73/0x150 ? __pfx_mem_allocator_disconnect+0x10/0x10 ? mark_held_locks+0xa5/0xf0 ? rcu_is_watching+0x11/0xb0 page_pool_release+0x36e/0x6d0 page_pool_destroy+0xd7/0x440 xdp_unreg_mem_model+0x1a7/0x2a0 ? __pfx_xdp_unreg_mem_model+0x10/0x10 ? kfree+0x125/0x370 ? bnxt_free_ring.isra.0+0x2eb/0x500 ? bnxt_free_mem+0x5ac/0x2500 xdp_rxq_info_unreg+0x4a/0xd0 bnxt_free_mem+0x1356/0x2500 bnxt_close_nic+0xf0/0x3b0 ? __pfx_bnxt_close_nic+0x10/0x10 ? ethnl_parse_bit+0x2c6/0x6d0 ? __pfx___nla_validate_parse+0x10/0x10 ? __pfx_ethnl_parse_bit+0x10/0x10 bnxt_set_features+0x2a8/0x3e0 __netdev_update_features+0x4dc/0x1370 ? ethnl_parse_bitset+0x4ff/0x750 ? __pfx_ethnl_parse_bitset+0x10/0x10 ? __pfx___netdev_update_features+0x10/0x10 ? mark_held_locks+0xa5/0xf0 ? _raw_spin_unlock_irqrestore+0x42/0x70 ? __pm_runtime_resume+0x7d/0x110 ethnl_set_features+0x32d/0xa20 To fix this problem, it uses rhashtable_lookup_fast() instead of rhashtable_lookup() with rcu_read_lock(). Using xa without rcu_read_lock() here is safe. xa is freed by __xdp_mem_allocator_rcu_free() and this is called by call_rcu() of mem_xa_remove(). The mem_xa_remove() is called by page_pool_destroy() if a reference count reaches 0. The xa is already protected by the reference count mechanism well in the control plane. So removing rcu_read_lock() for page_pool_destroy() is safe.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS