CVE-2024-36962: net: ks8851: Queue RX packets in IRQ handler instead of disabling BHs
In the Linux kernel, the following vulnerability has been resolved:
net: ks8851: Queue RX packets in IRQ handler instead of disabling BHs
Currently the driver uses local_bh_disable()/local_bh_enable() in its
IRQ handler to avoid triggering net_rx_action() softirq on exit from
netif_rx(). The net_rx_action() could trigger this driver .start_xmit
callback, which is protected by the same lock as the IRQ handler, so
calling the .start_xmit from netif_rx() from the IRQ handler critical
section protected by the lock could lead to an attempt to claim the
already claimed lock, and a hang.
The local_bh_disable()/local_bh_enable() approach works only in case
the IRQ handler is protected by a spinlock, but does not work if the
IRQ handler is protected by mutex, i.e. this works for KS8851 with
Parallel bus interface, but not for KS8851 with SPI bus interface.
Remove the BH manipulation and instead of calling netif_rx() inside
the IRQ handler code protected by the lock, queue all the received
SKBs in the IRQ handler into a queue first, and once the IRQ handler
exits the critical section protected by the lock, dequeue all the
queued SKBs and push them all into netif_rx(). At this point, it is
safe to trigger the net_rx_action() softirq, since the netif_rx()
call is outside of the lock that protects the IRQ handler.
Security readout for executives and security teams
Plain-English summary
This is a Linux kernel denial-of-service issue in the KS8851 network driver. Under the documented driver locking condition, packet handling can try to take a lock already held by the interrupt handler, causing a hang. Business impact is availability loss on systems that use this driver, not data theft or privilege escalation based on the supplied sources.
Executive priority
Handle through normal vulnerability management, with higher priority for embedded or operational systems where a network-driver hang affects service availability. There is no supplied evidence of data exposure, privilege escalation, or active exploitation, but downtime-sensitive deployments should not defer vendor kernel updates unnecessarily.
Technical view
The KS8851 IRQ handler called netif_rx() while inside a lock-protected critical section. netif_rx() could trigger net_rx_action(), which could call the same driver’s start_xmit path protected by the same lock. For the SPI variant using a mutex, this can deadlock. The fix queues received SKBs in IRQ context and submits them after leaving the lock.
Likely exposure
Exposure is most likely on Linux systems whose kernel includes and uses the KS8851 network driver, especially the SPI bus interface described in the record. The source bundle does not provide distribution package mappings, CPEs, or a complete affected-version range, so asset owners must map their kernel builds to the referenced stable fixes.
Exploitation context
The CVSS vector is local, low complexity, no privileges, no user interaction, with high availability impact. The source bundle says KEV is false and provides no evidence of active exploitation. Treat this as a stability and availability risk for relevant kernel deployments, not as a confirmed remotely exploited issue.
Researcher notes
The root cause is a locking and softirq interaction in the KS8851 receive path. The important distinction is bus interface behavior: the local_bh_disable approach worked with a spinlock-protected IRQ handler but not with the mutex-protected SPI path. Validate fixes by confirming RX SKBs are queued during the critical section and passed to netif_rx() afterward.
Mitigation direction
Check kernel vendor advisories for CVE-2024-36962 and applicable backports.
Update affected Linux kernels to builds containing the referenced stable fixes.
Prioritize devices that use the KS8851 driver or SPI bus interface.
If patching is delayed, assess whether the KS8851 driver is needed in deployed kernels.
Validation and detection
Inventory systems for Linux kernels using the KS8851 network driver.
Map running kernel versions to vendor advisories or the referenced stable commits.
Confirm patched builds include the SKB queueing change outside the IRQ lock.
Review crash, hang, and watchdog logs on systems using this driver.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Potential ATT&CK relevance
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
cve · low confidence lookup
CVE-2024-36962 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.