Executive brief
The Linux kernel's ibmvnic driver contains a flaw in its error recovery logic that can trigger a kernel crash when handling non-fatal adapter errors. During recovery from certain network adapter problems, the driver incorrectly resets queue statistics while partially transmitted data remains buffered, causing the kernel's dynamic queue limit system to detect an impossible state and crash the system. This affects systems using IBM virtual network adapters and can be triggered by transient adapter errors.
Technical details
The vulnerability is a denial-of-service flaw in the ibmvnic (IBM Virtual NIC) driver's handling of non-fatal device errors. The root cause is the driver calling netdev_tx_reset_queue() during recovery from NON_FATAL errors, which resets the Byte Queue Limit (BQL) statistics (num_queued and num_completed counters) to zero. However, unlike other reset types, NON_FATAL resets do not flush the transmit queue buffers, leaving batched skbs (socket buffers) pending. When these batched packets are later transmitted and completed, the driver calls netdev_tx_completed_queue() to increment num_completed, which exceeds the zeroed num_queued counter. This violates the BQL invariant and triggers a BUG_ON() crash in lib/dynamic_queue_limits.c. The attack vector is network-adjacent, requiring the adapter firmware to report transient errors. The fix involves skipping the DQL stats reset specifically for NON_FATAL error recovery.
Affected products
- Linux Linux kernel Affected versions prior to fix implementation
Timeline
- 2025-10-01: disclosed: Published on NVD
- 2023: other: Vulnerability identified in Linux kernel development cycle