Security readout for executives and security teams
Plain-English summary
A race between traffic-control configuration and reset handling in the Linux hns3 network driver can deadlock the driver. Affected systems could suffer network disruption or broader security impact when a locally authenticated user triggers the condition. Internet-based exploitation is not indicated by the supplied evidence.
Executive priority
Treat as high priority on network-critical systems that use hns3 and permit local traffic-control changes. Scope other systems first rather than assuming fleet-wide exposure. Expedite vendor kernel updates where both prerequisites are present; the supplied evidence does not justify an emergency response for remote exploitation.
Technical view
During an hns3 port reset, concurrent traffic-control setup can re-enable NAPI before the driver completes uninitialization. Subsequent reset processing can then deadlock. The kernel fix adds a DOWN operation during UINIT. The supplied CVSS 3.1 score is 7.8, requiring local access and low privileges, without user interaction.
Likely exposure
Exposure is limited to Linux systems using the affected hns3 driver where a low-privileged local user can configure traffic control during device reset. The supplied version data is ambiguous, so kernel package status should be confirmed through the relevant distribution or vendor advisory.
Exploitation context
The supplied record does not identify CISA KEV listing or active exploitation. The CVSS vector describes a local, low-complexity, low-privilege attack requiring no user interaction. No evidence in the bundle establishes remote reachability, public exploitation, or observed attacks.
Researcher notes
The race involves setup-TC and PF/global reset paths, particularly NAPI disable, deletion, addition, and enable sequencing. Stable commits implement an additional DOWN step during UINIT. Exact affected-version boundaries cannot be reliably reconstructed from the supplied version arrays, and no CWE or exploitation evidence is provided.
Mitigation direction
- Install a vendor-supported kernel containing the applicable stable fix.
- Check distribution advisories before deciding whether a deployed kernel package is affected.
- Restrict traffic-control configuration to trusted administrators where operationally feasible.
- Prioritize network-dependent hosts using the hns3 driver.
Validation and detection
- Inventory deployed kernels and determine which hosts load or use the hns3 driver.
- Compare each kernel package against its vendor advisory and patched release information.
- Confirm the applicable stable fix is present in custom-built kernels.
- Review affected hosts for unexplained hns3 resets, deadlocks, or network outages.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2024-44995 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/67492d4d105c0a6321b00c393eec96b9a7a97a16CVE reference, Linux
- https://git.kernel.org/stable/c/fc250eca15bde34c4c8f806b9d88f55bd56a992cCVE reference, Linux
- https://git.kernel.org/stable/c/195918217448a6bb7f929d6a2ffffce9f1ece1ccCVE reference, Linux
- https://git.kernel.org/stable/c/6ae2b7d63cd056f363045eb65409143e16f23ae8CVE reference, Linux
- https://git.kernel.org/stable/c/fa1d4de7265c370e673583ac8d1bd17d21826cd9CVE reference, Linux
- https://git.kernel.org/stable/c/de37408d5c26fc4a296a28a0c96dcb814219bfa1CVE reference, Linux
- https://git.kernel.org/stable/c/be5e816d00a506719e9dbb1a9c861c5ced30a109CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/01/msg00001.htmlCVE reference, CVE
- https://lists.debian.org/debian-lts-announce/2024/10/msg00003.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.