CVE-2024-43835virtio_net: Fix napi_skb_cache_put warning
- 5.5MediumCVSS base score
- 0.25%Exploitation in 30 daysEPSS · top 84% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: virtio_net: Fix napi_skb_cache_put warning After the commit bdacf3e34945 ("net: Use nested-BH locking for napi_alloc_cache.") was merged, the following warning began to appear: WARNING: CPU: 5 PID: 1 at net/core/skbuff.c:1451 napi_skb_cache_put+0x82/0x4b0 __warn+0x12f/0x340 napi_skb_cache_put+0x82/0x4b0 napi_skb_cache_put+0x82/0x4b0 report_bug+0x165/0x370 handle_bug+0x3d/0x80 exc_invalid_op+0x1a/0x50 asm_exc_invalid_op+0x1a/0x20 __free_old_xmit+0x1c8/0x510 napi_skb_cache_put+0x82/0x4b0 __free_old_xmit+0x1c8/0x510 __free_old_xmit+0x1c8/0x510 __pfx___free_old_xmit+0x10/0x10 The issue arises because virtio is assuming it's running in NAPI context even when it's not, such as in the netpoll case. To resolve this, modify virtnet_poll_tx() to only set NAPI when budget is available. Same for virtnet_poll_cleantx(), which always assumed that it was in a NAPI context.
Timeline
ID reserved
By Linux
Published
- 21 months later
· 21 months later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| NVDNVD · Modified | 3.1 | Medium5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
- EPSS (exploitation in 30 days)
- 0.25% · top 84% of all CVEs (14 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.5.
Affected products
- affected df133f3f96257ee29696c0ed8bd198ec801dc810 – < d3af435e8ace119e58d8e21d3d2d6a4e7c4a4baa
- affected df133f3f96257ee29696c0ed8bd198ec801dc810 – < 842a97b5e44f0c8a9fc356fe976e0e13ddcf7783
- affected df133f3f96257ee29696c0ed8bd198ec801dc810 – < cc7340f18e45886121c131227985d64ef666012f
- affected df133f3f96257ee29696c0ed8bd198ec801dc810 – < 6b5325f2457521bbece29499970c0117a648c620
- affected df133f3f96257ee29696c0ed8bd198ec801dc810 – < f5e9a22d19bb98a7e86034db85eb295e94187caa
- affected df133f3f96257ee29696c0ed8bd198ec801dc810 – < 468a729b78895893d0e580ceea49bed8ada2a2bd
- affected df133f3f96257ee29696c0ed8bd198ec801dc810 – < f8321fa75102246d7415a6af441872f6637c93ab
- affected 5.0
- unaffected < 5.0
- unaffected 5.4.284 – ≤ 5.4.*
- unaffected 5.10.226 – ≤ 5.10.*
- unaffected 5.15.167 – ≤ 5.15.*
- unaffected 6.1.109 – ≤ 6.1.*
- unaffected 6.6.50 – ≤ 6.6.*
- unaffected 6.10.3 – ≤ 6.10.*
- unaffected 6.11 – ≤ *
References
References9
- https://git.kernel.org/stable/c/d3af435e8ace119e58d8e21d3d2d6a4e7c4a4baa (opens in a new tab)
- https://git.kernel.org/stable/c/842a97b5e44f0c8a9fc356fe976e0e13ddcf7783 (opens in a new tab)
- https://git.kernel.org/stable/c/cc7340f18e45886121c131227985d64ef666012f (opens in a new tab)
- https://git.kernel.org/stable/c/6b5325f2457521bbece29499970c0117a648c620 (opens in a new tab)
- https://git.kernel.org/stable/c/f5e9a22d19bb98a7e86034db85eb295e94187caa (opens in a new tab)
- https://git.kernel.org/stable/c/468a729b78895893d0e580ceea49bed8ada2a2bd (opens in a new tab)
- https://git.kernel.org/stable/c/f8321fa75102246d7415a6af441872f6637c93ab (opens in a new tab)
- https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html (opens in a new tab)
- https://lists.debian.org/debian-lts-announce/2024/10/msg00003.html (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2024-40485 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2024-43835)Record last updated .