LiveActive security incident?Get immediate response
CVE Record

CVE-2024-36962: net: ks8851: Queue RX packets in IRQ handler instead of disabling BHs

In the Linux kernel, the following vulnerability has been resolved: net: ks8851: Queue RX packets in IRQ handler instead of disabling BHs Currently the driver uses local_bh_disable()/local_bh_enable() in its IRQ handler to avoid triggering net_rx_action() softirq on exit from netif_rx(). The net_rx_action() could trigger this driver .start_xmit callback, which is protected by the same lock as the IRQ handler, so calling the .start_xmit from netif_rx() from the IRQ handler critical section protected by the lock could lead to an attempt to claim the already claimed lock, and a hang. The local_bh_disable()/local_bh_enable() approach works only in case the IRQ handler is protected by a spinlock, but does not work if the IRQ handler is protected by mutex, i.e. this works for KS8851 with Parallel bus interface, but not for KS8851 with SPI bus interface. Remove the BH manipulation and instead of calling netif_rx() inside the IRQ handler code protected by the lock, queue all the received SKBs in the IRQ handler into a queue first, and once the IRQ handler exits the critical section protected by the lock, dequeue all the queued SKBs and push them all into netif_rx(). At this point, it is safe to trigger the net_rx_action() softirq, since the netif_rx() call is outside of the lock that protects the IRQ handler.

MediumCVSS 6.2Not KEV-listedUpdated
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

This is a Linux kernel denial-of-service issue in the KS8851 network driver. Under the documented driver locking condition, packet handling can try to take a lock already held by the interrupt handler, causing a hang. Business impact is availability loss on systems that use this driver, not data theft or privilege escalation based on the supplied sources.

Executive priority

Handle through normal vulnerability management, with higher priority for embedded or operational systems where a network-driver hang affects service availability. There is no supplied evidence of data exposure, privilege escalation, or active exploitation, but downtime-sensitive deployments should not defer vendor kernel updates unnecessarily.

Technical view

The KS8851 IRQ handler called netif_rx() while inside a lock-protected critical section. netif_rx() could trigger net_rx_action(), which could call the same driver’s start_xmit path protected by the same lock. For the SPI variant using a mutex, this can deadlock. The fix queues received SKBs in IRQ context and submits them after leaving the lock.

Likely exposure

Exposure is most likely on Linux systems whose kernel includes and uses the KS8851 network driver, especially the SPI bus interface described in the record. The source bundle does not provide distribution package mappings, CPEs, or a complete affected-version range, so asset owners must map their kernel builds to the referenced stable fixes.

Exploitation context

The CVSS vector is local, low complexity, no privileges, no user interaction, with high availability impact. The source bundle says KEV is false and provides no evidence of active exploitation. Treat this as a stability and availability risk for relevant kernel deployments, not as a confirmed remotely exploited issue.

Researcher notes

The root cause is a locking and softirq interaction in the KS8851 receive path. The important distinction is bus interface behavior: the local_bh_disable approach worked with a spinlock-protected IRQ handler but not with the mutex-protected SPI path. Validate fixes by confirming RX SKBs are queued during the critical section and passed to netif_rx() afterward.

Mitigation direction

  • Check kernel vendor advisories for CVE-2024-36962 and applicable backports.
  • Update affected Linux kernels to builds containing the referenced stable fixes.
  • Prioritize devices that use the KS8851 driver or SPI bus interface.
  • If patching is delayed, assess whether the KS8851 driver is needed in deployed kernels.

Validation and detection

  • Inventory systems for Linux kernels using the KS8851 network driver.
  • Map running kernel versions to vendor advisories or the referenced stable commits.
  • Confirm patched builds include the SKB queueing change outside the IRQ lock.
  • Review crash, hang, and watchdog logs on systems using this driver.
Prepared
Confidence
medium
Sources
6

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2024-36962 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Medium
CVSS
6.2 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
2ADP providers
5Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
6.2CVSS 3.1MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H2.53.6CISA-ADP

Vulnerability scoring details

Base CVSS 3.1 score

6.2Medium
CVSS 3.1 vector shape for CVE-2024-36962Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
cvssV3_1other:ssvc
CVECVE Program Container
Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux492337a4fbd1421b42df684ee9b34be2a2722540, cba376eb036c2c20077b41d47b317d8218fe754f, 49d5d70538b6b8f2a3f8f1ac30c1f921d4a0929b, be0384bf599cf1eb8d337517feeb732d71f75a6funaffected
LinuxLinux6.1.87, 6.6.28, 6.8.7unaffected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.