Security readout for executives and security teams
Plain-English summary
A Linux network-driver flaw can unmap the same DMA memory twice when the bnxt_en driver processes XDP_REDIRECT traffic. The supplied record rates it critical, but the documented symptom is a kernel warning; it does not establish compromise or a remotely practical attack.
Executive priority
Treat confirmed exposure as an urgent patching task because the official rating is critical and the defect affects kernel memory-device mapping. Temper incident-response escalation: the supplied sources do not demonstrate exploitation or actual compromise. Systems without bnxt_en and XDP_REDIRECT are unlikely to reach the documented path.
Technical view
The bnxt_en XDP_REDIRECT path called dma_unmap_page_attrs() after DMA mapping responsibility had moved to the page pool, causing duplicate unmapping. The referenced kernel fixes remove that call. The supplied CVSS is 10.0, although the evidence provided demonstrates an IOMMU warning rather than confidentiality, integrity, or availability loss.
Likely exposure
Exposure requires a Linux kernel containing the vulnerable bnxt_en code and use of its XDP_REDIRECT path. The supplied affected-version data names 6.6 through later releases but is ambiguous and duplicated, so distribution-specific kernel status must be verified against the referenced fixes.
Exploitation context
The supplied record is not in KEV and provides no evidence of active exploitation, public weaponization, or a proven remote attack. Its network CVSS vector indicates severe theoretical impact, but the underlying evidence only shows the faulty path producing a kernel warning.
Researcher notes
The security impact is under-evidenced relative to the 10.0 vector. The record supplies no CWE and its normalized version list is unclear. Researchers should distinguish the reproducible double-unmap warning from claims of remote code execution or data compromise, which these sources do not substantiate.
Mitigation direction
- Install a vendor-supported kernel containing the applicable referenced stable fix.
- Check Linux distribution advisories for corrected package versions and backports.
- Avoid the affected bnxt_en XDP_REDIRECT path until patching if operationally feasible.
- Prioritize exposed, high-throughput systems using this driver and XDP configuration.
Validation and detection
- Inventory kernel versions and systems loading the bnxt_en driver.
- Determine whether XDP_REDIRECT is configured or exercised on affected interfaces.
- Verify the installed kernel includes the applicable referenced fix or vendor backport.
- Review kernel logs for iommu_dma_unmap_page warnings involving bnxt_rx_xdp.
- Retest affected networking after updating and confirm the warning no longer occurs.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2024-44984 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 10 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H3.96LinuxVulnerability scoring details
Base CVSS 3.1 score
10CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/fa4e6ae38574d0fc5596272bee64727d8ab7052bCVE reference, Linux
- https://git.kernel.org/stable/c/95a305ba259b685780ed62ea2295aa2feb2d6c0cCVE reference, Linux
- https://git.kernel.org/stable/c/8baeef7616d5194045c5a6b97fd1246b87c55b13CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.