CVE-2024-26820: hv_netvsc: Register VF in netvsc_probe if NET_DEVICE_REGISTER missed
In the Linux kernel, the following vulnerability has been resolved:
hvnetvsc: Register VF in netvscprobe if NETDEVICEREGISTER missed
If hvnetvsc driver is unloaded and reloaded, the NETDEVICEREGISTER handler cannot perform VF register successfully as the register call is received before netvscprobe is finished. This is because we register registernetdevicenotifier() very early( even before vmbusdriverregister()). To fix this, we try to register each such matching VF( if it is visible as a netdevice) at the end of netvscprobe.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-26820?
CVE-2024-26820 has a moderate severity level as it involves issues with the netvsc driver related to VF registration.
How do I fix CVE-2024-26820?
To fix CVE-2024-26820, ensure that you update to the patched versions of the Linux kernel: 5.10.223-1, 5.10.226-1, 6.1.123-1, 6.1.119-1, 6.12.11-1, or 6.12.12-1.
Which software is affected by CVE-2024-26820?
CVE-2024-26820 affects specific versions of the Linux kernel packages provided by Debian.
What does CVE-2024-26820 involve?
CVE-2024-26820 involves a vulnerability in the hv_netvsc driver where the VF registration fails after the driver is unloaded and reloaded.
Is there a workaround for CVE-2024-26820?
While the most effective mitigation is to upgrade to a fixed kernel version, specific workarounds depend on the system configuration and use case.