{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-35971",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-20T15:04:05.232058Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:33:27.183Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T03:21:49.046Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/492337a4fbd1421b42df684ee9b34be2a2722540"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/cba376eb036c2c20077b41d47b317d8218fe754f"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/49d5d70538b6b8f2a3f8f1ac30c1f921d4a0929b"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/be0384bf599cf1eb8d337517feeb732d71f75a6f"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2024/05/30/2"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2024/05/30/1"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/micrel/ks8851_common.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "492337a4fbd1421b42df684ee9b34be2a2722540",
              "status": "affected",
              "version": "797047f875b5463719cc70ba213eb691d453c946",
              "versionType": "git"
            },
            {
              "lessThan": "cba376eb036c2c20077b41d47b317d8218fe754f",
              "status": "affected",
              "version": "797047f875b5463719cc70ba213eb691d453c946",
              "versionType": "git"
            },
            {
              "lessThan": "49d5d70538b6b8f2a3f8f1ac30c1f921d4a0929b",
              "status": "affected",
              "version": "797047f875b5463719cc70ba213eb691d453c946",
              "versionType": "git"
            },
            {
              "lessThan": "be0384bf599cf1eb8d337517feeb732d71f75a6f",
              "status": "affected",
              "version": "797047f875b5463719cc70ba213eb691d453c946",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/micrel/ks8851_common.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.8"
            },
            {
              "lessThan": "5.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.87",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.28",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.8.*",
              "status": "unaffected",
              "version": "6.8.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.9",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.87",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.28",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8.7",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ks8851: Handle softirqs at the end of IRQ thread to fix hang\n\nThe ks8851_irq() thread may call ks8851_rx_pkts() in case there are\nany packets in the MAC FIFO, which calls netif_rx(). This netif_rx()\nimplementation is guarded by local_bh_disable() and local_bh_enable().\nThe local_bh_enable() may call do_softirq() to run softirqs in case\nany are pending. One of the softirqs is net_rx_action, which ultimately\nreaches the driver .start_xmit callback. If that happens, the system\nhangs. The entire call chain is below:\n\nks8851_start_xmit_par from netdev_start_xmit\nnetdev_start_xmit from dev_hard_start_xmit\ndev_hard_start_xmit from sch_direct_xmit\nsch_direct_xmit from __dev_queue_xmit\n__dev_queue_xmit from __neigh_update\n__neigh_update from neigh_update\nneigh_update from arp_process.constprop.0\narp_process.constprop.0 from __netif_receive_skb_one_core\n__netif_receive_skb_one_core from process_backlog\nprocess_backlog from __napi_poll.constprop.0\n__napi_poll.constprop.0 from net_rx_action\nnet_rx_action from __do_softirq\n__do_softirq from call_with_stack\ncall_with_stack from do_softirq\ndo_softirq from __local_bh_enable_ip\n__local_bh_enable_ip from netif_rx\nnetif_rx from ks8851_irq\nks8851_irq from irq_thread_fn\nirq_thread_fn from irq_thread\nirq_thread from kthread\nkthread from ret_from_fork\n\nThe hang happens because ks8851_irq() first locks a spinlock in\nks8851_par.c ks8851_lock_par() spin_lock_irqsave(\u0026ksp-\u003elock, ...)\nand with that spinlock locked, calls netif_rx(). Once the execution\nreaches ks8851_start_xmit_par(), it calls ks8851_lock_par() again\nwhich attempts to claim the already locked spinlock again, and the\nhang happens.\n\nMove the do_softirq() call outside of the spinlock protected section\nof ks8851_irq() by disabling BHs around the entire spinlock protected\nsection of ks8851_irq() handler. Place local_bh_enable() outside of\nthe spinlock protected section, so that it can trigger do_softirq()\nwithout the ks8851_par.c ks8851_lock_par() spinlock being held, and\nsafely call ks8851_start_xmit_par() without attempting to lock the\nalready locked spinlock.\n\nSince ks8851_irq() is protected by local_bh_disable()/local_bh_enable()\nnow, replace netif_rx() with __netif_rx() which is not duplicating the\nlocal_bh_disable()/local_bh_enable() calls."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The deadlock is triggered purely by a received Ethernet frame whose RX processing emits an immediate reply in softirq context \u2014 ICMP echo requests, TCP SYNs eliciting SYN-ACKs, and forwarded traffic all do this and are routable from an arbitrary remote host, not just the local segment. Per net/ stack guidance, bugs reachable via received packets are Network.\nAC:L - The attacker fully controls the trigger by sending a single packet that elicits a reply (ping, ARP request, TCP SYN); no race, memory layout, or victim state is involved, and the hang even occurs under ordinary legitimate traffic.\nPR:N - The vulnerable code runs in the NIC\u0027s threaded IRQ handler on raw packet reception, entirely before any socket, authentication, or authorization check \u2014 an unauthenticated remote attacker needs no credentials on the target.\nUI:N - No victim action is required; the packet is processed automatically by the driver\u0027s interrupt thread as soon as it arrives on the wire.\nS:U - The recursive spinlock acquisition deadlocks the kernel itself, with no crossing of a virtualization, IOMMU, or sandbox boundary \u2014 impact stays within the same security authority.\nC:N - The bug is a lock-recursion deadlock with no out-of-bounds access, no use-after-free, and no leaked data; the fix only reorders BH handling and switches to __netif_rx(), confirming no information is exposed.\nI:N - No memory is corrupted and no data is modified \u2014 the CPU simply spins forever on a lock it already holds, giving no write primitive of any kind.\nA:H - Re-acquiring the non-recursive spinlock taken with spin_lock_irqsave() wedges the CPU with local interrupts disabled, producing a full system hang (unrecoverable without watchdog reset on the typical single-core embedded boards using the KS8851 parallel bus)."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:31:19.610Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/492337a4fbd1421b42df684ee9b34be2a2722540"
        },
        {
          "url": "https://git.kernel.org/stable/c/cba376eb036c2c20077b41d47b317d8218fe754f"
        },
        {
          "url": "https://git.kernel.org/stable/c/49d5d70538b6b8f2a3f8f1ac30c1f921d4a0929b"
        },
        {
          "url": "https://git.kernel.org/stable/c/be0384bf599cf1eb8d337517feeb732d71f75a6f"
        }
      ],
      "title": "net: ks8851: Handle softirqs at the end of IRQ thread to fix hang",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-35971",
    "datePublished": "2024-05-20T09:41:59.174Z",
    "dateReserved": "2024-05-17T13:50:33.141Z",
    "dateUpdated": "2026-08-05T11:31:19.610Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-35971",
      "date": "2026-08-09",
      "epss": "0.00685",
      "percentile": "0.49171"
    },
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet: ks8851: Handle softirqs at the end of IRQ thread to fix hang\\n\\nThe ks8851_irq() thread may call ks8851_rx_pkts() in case there are\\nany packets in the MAC FIFO, which calls netif_rx(). This netif_rx()\\nimplementation is guarded by local_bh_disable() and local_bh_enable().\\nThe local_bh_enable() may call do_softirq() to run softirqs in case\\nany are pending. One of the softirqs is net_rx_action, which ultimately\\nreaches the driver .start_xmit callback. If that happens, the system\\nhangs. The entire call chain is below:\\n\\nks8851_start_xmit_par from netdev_start_xmit\\nnetdev_start_xmit from dev_hard_start_xmit\\ndev_hard_start_xmit from sch_direct_xmit\\nsch_direct_xmit from __dev_queue_xmit\\n__dev_queue_xmit from __neigh_update\\n__neigh_update from neigh_update\\nneigh_update from arp_process.constprop.0\\narp_process.constprop.0 from __netif_receive_skb_one_core\\n__netif_receive_skb_one_core from process_backlog\\nprocess_backlog from __napi_poll.constprop.0\\n__napi_poll.constprop.0 from net_rx_action\\nnet_rx_action from __do_softirq\\n__do_softirq from call_with_stack\\ncall_with_stack from do_softirq\\ndo_softirq from __local_bh_enable_ip\\n__local_bh_enable_ip from netif_rx\\nnetif_rx from ks8851_irq\\nks8851_irq from irq_thread_fn\\nirq_thread_fn from irq_thread\\nirq_thread from kthread\\nkthread from ret_from_fork\\n\\nThe hang happens because ks8851_irq() first locks a spinlock in\\nks8851_par.c ks8851_lock_par() spin_lock_irqsave(\u0026ksp-\u003elock, ...)\\nand with that spinlock locked, calls netif_rx(). Once the execution\\nreaches ks8851_start_xmit_par(), it calls ks8851_lock_par() again\\nwhich attempts to claim the already locked spinlock again, and the\\nhang happens.\\n\\nMove the do_softirq() call outside of the spinlock protected section\\nof ks8851_irq() by disabling BHs around the entire spinlock protected\\nsection of ks8851_irq() handler. Place local_bh_enable() outside of\\nthe spinlock protected section, so that it can trigger do_softirq()\\nwithout the ks8851_par.c ks8851_lock_par() spinlock being held, and\\nsafely call ks8851_start_xmit_par() without attempting to lock the\\nalready locked spinlock.\\n\\nSince ks8851_irq() is protected by local_bh_disable()/local_bh_enable()\\nnow, replace netif_rx() with __netif_rx() which is not duplicating the\\nlocal_bh_disable()/local_bh_enable() calls.\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net: ks8851: maneja softirqs al final del subproceso IRQ para corregir el bloqueo. El subproceso ks8851_irq() puede llamar a ks8851_rx_pkts() en caso de que haya paquetes en MAC FIFO, que llama netif_rx(). Esta implementaci\\u00f3n de netif_rx() est\\u00e1 protegida por local_bh_disable() y local_bh_enable(). local_bh_enable() puede llamar a do_softirq() para ejecutar softirqs en caso de que haya alguno pendiente. Uno de los softirqs es net_rx_action, que finalmente llega a la devoluci\\u00f3n de llamada .start_xmit del controlador. Si eso sucede, el sistema se bloquea. La cadena de llamadas completa est\\u00e1 a continuaci\\u00f3n: ks8851_start_xmit_par de netdev_start_xmit netdev_start_xmit de dev_hard_start_xmit dev_hard_start_xmit de sch_direct_xmit sch_direct_xmit de __dev_queue_xmit __dev_queue_xmit de __neigh_update __neigh_update de neigh_update neigh_update de .constprop.0 arp_process.constprop.0 de __netif_receive_skb_one_core __netif_receive_skb_one_core de Process_backlog Process_backlog de __napi_poll.constprop.0 __napi_poll .constprop.0 de net_rx_action net_rx_action de __do_softirq __do_softirq de call_with_stack call_with_stack de do_softirq do_softirq de __local_bh_enable_ip __local_bh_enable_ip de netif_rx netif_rx de ks8851_irq ks8851_irq de irq_thread_fn _thread_fn de irq_thread irq_thread de kthread kthread de ret_from_fork El bloqueo ocurre porque ks8851_irq() primero bloquea un spinlock en ks8851_par. c ks8851_lock_par() spin_lock_irqsave(\u0026amp;ksp-\u0026gt;lock, ...) y con ese spinlock bloqueado, llama a netif_rx(). Una vez que la ejecuci\\u00f3n llega a ks8851_start_xmit_par(), llama nuevamente a ks8851_lock_par(), lo que intenta reclamar el spinlock ya bloqueado nuevamente y se bloquea. Mueva la llamada do_softirq() fuera de la secci\\u00f3n protegida por spinlock de ks8851_irq() deshabilitando los BH alrededor de toda la secci\\u00f3n protegida por spinlock del controlador ks8851_irq(). Coloque local_bh_enable() fuera de la secci\\u00f3n protegida de spinlock, para que pueda activar do_softirq() sin que se mantenga el spinlock ks8851_par.c ks8851_lock_par(), y llame de forma segura a ks8851_start_xmit_par() sin intentar bloquear el spinlock ya bloqueado. Dado que ks8851_irq() est\\u00e1 protegido por local_bh_disable()/local_bh_enable() ahora, reemplace netif_rx() con __netif_rx() que no duplica las llamadas local_bh_disable()/local_bh_enable().\"}]",
      "id": "CVE-2024-35971",
      "lastModified": "2024-11-21T09:21:19.700",
      "published": "2024-05-20T10:15:11.947",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/492337a4fbd1421b42df684ee9b34be2a2722540\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/49d5d70538b6b8f2a3f8f1ac30c1f921d4a0929b\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/be0384bf599cf1eb8d337517feeb732d71f75a6f\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/cba376eb036c2c20077b41d47b317d8218fe754f\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"http://www.openwall.com/lists/oss-security/2024/05/30/1\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://www.openwall.com/lists/oss-security/2024/05/30/2\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/492337a4fbd1421b42df684ee9b34be2a2722540\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/49d5d70538b6b8f2a3f8f1ac30c1f921d4a0929b\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/be0384bf599cf1eb8d337517feeb732d71f75a6f\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/cba376eb036c2c20077b41d47b317d8218fe754f\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Awaiting Analysis"
    },
    "microsoft_vex": {
      "current_release_date": "2026-03-31T15:11:43.000Z",
      "cve": "CVE-2024-35971",
      "id": "msrc_CVE-2024-35971",
      "initial_release_date": "2024-05-02T07:00:00.000Z",
      "product_status:known_affected": "3",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "net: ks8851: Handle softirqs at the end of IRQ thread to fix hang",
      "url": "https://msrc.microsoft.com/csaf/vex/2024/msrc_cve-2024-35971.json",
      "version": "3"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-35971\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-05-20T10:15:11.947\",\"lastModified\":\"2026-08-04T11:18:17.353\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet: ks8851: Handle softirqs at the end of IRQ thread to fix hang\\n\\nThe ks8851_irq() thread may call ks8851_rx_pkts() in case there are\\nany packets in the MAC FIFO, which calls netif_rx(). This netif_rx()\\nimplementation is guarded by local_bh_disable() and local_bh_enable().\\nThe local_bh_enable() may call do_softirq() to run softirqs in case\\nany are pending. One of the softirqs is net_rx_action, which ultimately\\nreaches the driver .start_xmit callback. If that happens, the system\\nhangs. The entire call chain is below:\\n\\nks8851_start_xmit_par from netdev_start_xmit\\nnetdev_start_xmit from dev_hard_start_xmit\\ndev_hard_start_xmit from sch_direct_xmit\\nsch_direct_xmit from __dev_queue_xmit\\n__dev_queue_xmit from __neigh_update\\n__neigh_update from neigh_update\\nneigh_update from arp_process.constprop.0\\narp_process.constprop.0 from __netif_receive_skb_one_core\\n__netif_receive_skb_one_core from process_backlog\\nprocess_backlog from __napi_poll.constprop.0\\n__napi_poll.constprop.0 from net_rx_action\\nnet_rx_action from __do_softirq\\n__do_softirq from call_with_stack\\ncall_with_stack from do_softirq\\ndo_softirq from __local_bh_enable_ip\\n__local_bh_enable_ip from netif_rx\\nnetif_rx from ks8851_irq\\nks8851_irq from irq_thread_fn\\nirq_thread_fn from irq_thread\\nirq_thread from kthread\\nkthread from ret_from_fork\\n\\nThe hang happens because ks8851_irq() first locks a spinlock in\\nks8851_par.c ks8851_lock_par() spin_lock_irqsave(\u0026ksp-\u003elock, ...)\\nand with that spinlock locked, calls netif_rx(). Once the execution\\nreaches ks8851_start_xmit_par(), it calls ks8851_lock_par() again\\nwhich attempts to claim the already locked spinlock again, and the\\nhang happens.\\n\\nMove the do_softirq() call outside of the spinlock protected section\\nof ks8851_irq() by disabling BHs around the entire spinlock protected\\nsection of ks8851_irq() handler. Place local_bh_enable() outside of\\nthe spinlock protected section, so that it can trigger do_softirq()\\nwithout the ks8851_par.c ks8851_lock_par() spinlock being held, and\\nsafely call ks8851_start_xmit_par() without attempting to lock the\\nalready locked spinlock.\\n\\nSince ks8851_irq() is protected by local_bh_disable()/local_bh_enable()\\nnow, replace netif_rx() with __netif_rx() which is not duplicating the\\nlocal_bh_disable()/local_bh_enable() calls.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net: ks8851: maneja softirqs al final del subproceso IRQ para corregir el bloqueo. El subproceso ks8851_irq() puede llamar a ks8851_rx_pkts() en caso de que haya paquetes en MAC FIFO, que llama netif_rx(). Esta implementaci\u00f3n de netif_rx() est\u00e1 protegida por local_bh_disable() y local_bh_enable(). local_bh_enable() puede llamar a do_softirq() para ejecutar softirqs en caso de que haya alguno pendiente. Uno de los softirqs es net_rx_action, que finalmente llega a la devoluci\u00f3n de llamada .start_xmit del controlador. Si eso sucede, el sistema se bloquea. La cadena de llamadas completa est\u00e1 a continuaci\u00f3n: ks8851_start_xmit_par de netdev_start_xmit netdev_start_xmit de dev_hard_start_xmit dev_hard_start_xmit de sch_direct_xmit sch_direct_xmit de __dev_queue_xmit __dev_queue_xmit de __neigh_update __neigh_update de neigh_update neigh_update de .constprop.0 arp_process.constprop.0 de __netif_receive_skb_one_core __netif_receive_skb_one_core de Process_backlog Process_backlog de __napi_poll.constprop.0 __napi_poll .constprop.0 de net_rx_action net_rx_action de __do_softirq __do_softirq de call_with_stack call_with_stack de do_softirq do_softirq de __local_bh_enable_ip __local_bh_enable_ip de netif_rx netif_rx de ks8851_irq ks8851_irq de irq_thread_fn _thread_fn de irq_thread irq_thread de kthread kthread de ret_from_fork El bloqueo ocurre porque ks8851_irq() primero bloquea un spinlock en ks8851_par. c ks8851_lock_par() spin_lock_irqsave(\u0026amp;ksp-\u0026gt;lock, ...) y con ese spinlock bloqueado, llama a netif_rx(). Una vez que la ejecuci\u00f3n llega a ks8851_start_xmit_par(), llama nuevamente a ks8851_lock_par(), lo que intenta reclamar el spinlock ya bloqueado nuevamente y se bloquea. Mueva la llamada do_softirq() fuera de la secci\u00f3n protegida por spinlock de ks8851_irq() deshabilitando los BH alrededor de toda la secci\u00f3n protegida por spinlock del controlador ks8851_irq(). Coloque local_bh_enable() fuera de la secci\u00f3n protegida de spinlock, para que pueda activar do_softirq() sin que se mantenga el spinlock ks8851_par.c ks8851_lock_par(), y llame de forma segura a ks8851_start_xmit_par() sin intentar bloquear el spinlock ya bloqueado. Dado que ks8851_irq() est\u00e1 protegido por local_bh_disable()/local_bh_enable() ahora, reemplace netif_rx() con __netif_rx() que no duplica las llamadas local_bh_disable()/local_bh_enable().\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/net/ethernet/micrel/ks8851_common.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"797047f875b5463719cc70ba213eb691d453c946\",\"lessThan\":\"492337a4fbd1421b42df684ee9b34be2a2722540\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"797047f875b5463719cc70ba213eb691d453c946\",\"lessThan\":\"cba376eb036c2c20077b41d47b317d8218fe754f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"797047f875b5463719cc70ba213eb691d453c946\",\"lessThan\":\"49d5d70538b6b8f2a3f8f1ac30c1f921d4a0929b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"797047f875b5463719cc70ba213eb691d453c946\",\"lessThan\":\"be0384bf599cf1eb8d337517feeb732d71f75a6f\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/net/ethernet/micrel/ks8851_common.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.8\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.8\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.87\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.28\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.8.7\",\"lessThanOrEqual\":\"6.8.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.9\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-05-20T15:04:05.232058Z\",\"id\":\"CVE-2024-35971\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-667\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.8\",\"versionEndExcluding\":\"6.1.87\",\"matchCriteriaId\":\"616CD3F2-817C-407C-B3B0-742322DCD883\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.28\",\"matchCriteriaId\":\"8D6315B0-B3BA-406C-B0DB-51D9A63753F0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.8.7\",\"matchCriteriaId\":\"531BDFB5-EF6A-4707-902E-146368303499\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.9:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"22BEDD49-2C6D-402D-9DBF-6646F6ECD10B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.9:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"DF73CB2A-DFFD-46FB-9BFE-AA394F27EA37\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.9:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"52048DDA-FC5A-4363-95A0-A6357B4D7F8C\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/492337a4fbd1421b42df684ee9b34be2a2722540\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/49d5d70538b6b8f2a3f8f1ac30c1f921d4a0929b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/be0384bf599cf1eb8d337517feeb732d71f75a6f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/cba376eb036c2c20077b41d47b317d8218fe754f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"http://www.openwall.com/lists/oss-security/2024/05/30/1\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\"]},{\"url\":\"http://www.openwall.com/lists/oss-security/2024/05/30/2\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\"]},{\"url\":\"https://git.kernel.org/stable/c/492337a4fbd1421b42df684ee9b34be2a2722540\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/49d5d70538b6b8f2a3f8f1ac30c1f921d4a0929b\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/be0384bf599cf1eb8d337517feeb732d71f75a6f\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/cba376eb036c2c20077b41d47b317d8218fe754f\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T19:03:09+00:00",
      "cve": "CVE-2024-35971",
      "id": "CVE-2024-35971",
      "initial_release_date": "2024-05-20T00:00:00+00:00",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: net: ks8851: Handle softirqs at the end of IRQ thread to fix hang",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-35971.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-07-23T02:06:11Z",
      "cve": "CVE-2024-35971",
      "id": "CVE-2024-35971",
      "initial_release_date": "2024-05-21T01:58:40Z",
      "product_status:known_affected": "340",
      "product_status:known_not_affected": "181",
      "product_status:recommended": "650",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-35971",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-35971.json",
      "version": "111"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/492337a4fbd1421b42df684ee9b34be2a2722540\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/cba376eb036c2c20077b41d47b317d8218fe754f\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/49d5d70538b6b8f2a3f8f1ac30c1f921d4a0929b\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/be0384bf599cf1eb8d337517feeb732d71f75a6f\", \"tags\": [\"x_transferred\"]}, {\"url\": \"http://www.openwall.com/lists/oss-security/2024/05/30/2\", \"tags\": [\"x_transferred\"]}, {\"url\": \"http://www.openwall.com/lists/oss-security/2024/05/30/1\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T03:21:49.046Z\"}}, {\"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-35971\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-05-20T15:04:05.232058Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-05-23T19:01:24.904Z\"}, \"title\": \"CISA ADP Vulnrichment\"}], \"cna\": {\"title\": \"net: ks8851: Handle softirqs at the end of IRQ thread to fix hang\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.5, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:N - The deadlock is triggered purely by a received Ethernet frame whose RX processing emits an immediate reply in softirq context \\u2014 ICMP echo requests, TCP SYNs eliciting SYN-ACKs, and forwarded traffic all do this and are routable from an arbitrary remote host, not just the local segment. Per net/ stack guidance, bugs reachable via received packets are Network.\\nAC:L - The attacker fully controls the trigger by sending a single packet that elicits a reply (ping, ARP request, TCP SYN); no race, memory layout, or victim state is involved, and the hang even occurs under ordinary legitimate traffic.\\nPR:N - The vulnerable code runs in the NIC\u0027s threaded IRQ handler on raw packet reception, entirely before any socket, authentication, or authorization check \\u2014 an unauthenticated remote attacker needs no credentials on the target.\\nUI:N - No victim action is required; the packet is processed automatically by the driver\u0027s interrupt thread as soon as it arrives on the wire.\\nS:U - The recursive spinlock acquisition deadlocks the kernel itself, with no crossing of a virtualization, IOMMU, or sandbox boundary \\u2014 impact stays within the same security authority.\\nC:N - The bug is a lock-recursion deadlock with no out-of-bounds access, no use-after-free, and no leaked data; the fix only reorders BH handling and switches to __netif_rx(), confirming no information is exposed.\\nI:N - No memory is corrupted and no data is modified \\u2014 the CPU simply spins forever on a lock it already holds, giving no write primitive of any kind.\\nA:H - Re-acquiring the non-recursive spinlock taken with spin_lock_irqsave() wedges the CPU with local interrupts disabled, producing a full system hang (unrecoverable without watchdog reset on the typical single-core embedded boards using the KS8851 parallel bus).\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"797047f875b5463719cc70ba213eb691d453c946\", \"lessThan\": \"492337a4fbd1421b42df684ee9b34be2a2722540\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"797047f875b5463719cc70ba213eb691d453c946\", \"lessThan\": \"cba376eb036c2c20077b41d47b317d8218fe754f\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"797047f875b5463719cc70ba213eb691d453c946\", \"lessThan\": \"49d5d70538b6b8f2a3f8f1ac30c1f921d4a0929b\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"797047f875b5463719cc70ba213eb691d453c946\", \"lessThan\": \"be0384bf599cf1eb8d337517feeb732d71f75a6f\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/net/ethernet/micrel/ks8851_common.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.8\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.8\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.1.87\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.28\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.8.7\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.8.*\"}, {\"status\": \"unaffected\", \"version\": \"6.9\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/net/ethernet/micrel/ks8851_common.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/492337a4fbd1421b42df684ee9b34be2a2722540\"}, {\"url\": \"https://git.kernel.org/stable/c/cba376eb036c2c20077b41d47b317d8218fe754f\"}, {\"url\": \"https://git.kernel.org/stable/c/49d5d70538b6b8f2a3f8f1ac30c1f921d4a0929b\"}, {\"url\": \"https://git.kernel.org/stable/c/be0384bf599cf1eb8d337517feeb732d71f75a6f\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet: ks8851: Handle softirqs at the end of IRQ thread to fix hang\\n\\nThe ks8851_irq() thread may call ks8851_rx_pkts() in case there are\\nany packets in the MAC FIFO, which calls netif_rx(). This netif_rx()\\nimplementation is guarded by local_bh_disable() and local_bh_enable().\\nThe local_bh_enable() may call do_softirq() to run softirqs in case\\nany are pending. One of the softirqs is net_rx_action, which ultimately\\nreaches the driver .start_xmit callback. If that happens, the system\\nhangs. The entire call chain is below:\\n\\nks8851_start_xmit_par from netdev_start_xmit\\nnetdev_start_xmit from dev_hard_start_xmit\\ndev_hard_start_xmit from sch_direct_xmit\\nsch_direct_xmit from __dev_queue_xmit\\n__dev_queue_xmit from __neigh_update\\n__neigh_update from neigh_update\\nneigh_update from arp_process.constprop.0\\narp_process.constprop.0 from __netif_receive_skb_one_core\\n__netif_receive_skb_one_core from process_backlog\\nprocess_backlog from __napi_poll.constprop.0\\n__napi_poll.constprop.0 from net_rx_action\\nnet_rx_action from __do_softirq\\n__do_softirq from call_with_stack\\ncall_with_stack from do_softirq\\ndo_softirq from __local_bh_enable_ip\\n__local_bh_enable_ip from netif_rx\\nnetif_rx from ks8851_irq\\nks8851_irq from irq_thread_fn\\nirq_thread_fn from irq_thread\\nirq_thread from kthread\\nkthread from ret_from_fork\\n\\nThe hang happens because ks8851_irq() first locks a spinlock in\\nks8851_par.c ks8851_lock_par() spin_lock_irqsave(\u0026ksp-\u003elock, ...)\\nand with that spinlock locked, calls netif_rx(). Once the execution\\nreaches ks8851_start_xmit_par(), it calls ks8851_lock_par() again\\nwhich attempts to claim the already locked spinlock again, and the\\nhang happens.\\n\\nMove the do_softirq() call outside of the spinlock protected section\\nof ks8851_irq() by disabling BHs around the entire spinlock protected\\nsection of ks8851_irq() handler. Place local_bh_enable() outside of\\nthe spinlock protected section, so that it can trigger do_softirq()\\nwithout the ks8851_par.c ks8851_lock_par() spinlock being held, and\\nsafely call ks8851_start_xmit_par() without attempting to lock the\\nalready locked spinlock.\\n\\nSince ks8851_irq() is protected by local_bh_disable()/local_bh_enable()\\nnow, replace netif_rx() with __netif_rx() which is not duplicating the\\nlocal_bh_disable()/local_bh_enable() calls.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.87\", \"versionStartIncluding\": \"5.8\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.28\", \"versionStartIncluding\": \"5.8\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.8.7\", \"versionStartIncluding\": \"5.8\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.9\", \"versionStartIncluding\": \"5.8\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:31:19.610Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-35971\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:31:19.610Z\", \"dateReserved\": \"2024-05-17T13:50:33.141Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-05-20T09:41:59.174Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}