HIGH
gve NAPI Race
CVE-2025-71156
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI5.5MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: gve: defer interrupt enabling until NAPI registration Currently, interrupts are automatically enabled immediately upon request. This allows interrupt to fire before the associated NAPI context is fully initialized and cause failures like below: [ 0.946369] Call Trace: [ 0.946369] <IRQ> [ 0.946369] __napi_poll+0x2a/0x1e0 [ 0.946369] net_rx_action+0x2f9/0x3f0 [ 0.946369] handle_softirqs+0xd6/0x2c0 [ 0.946369] ? handle_edge_irq+0xc1/0x1b0 [ 0.946369] __irq_exit_rcu+0xc3/0xe0 [ 0.946369] common_interrupt+0x81/0xa0 [ 0.946369] </IRQ> [ 0.946369] <TASK> [ 0.946369] asm_common_interrupt+0x22/0x40 [ 0.946369] RIP: 0010:pv_native_safe_halt+0xb/0x10 Use the `IRQF_NO_AUTOEN` flag when requesting interrupts to prevent auto enablement and explicitly enable the interrupt in NAPI initialization path (and disable it during NAPI teardown). This ensures that interrupt lifecycle is strictly coupled with readiness of NAPI context.
02KernelScan AI Analysis
Risk summary
Systems using Google Virtual Ethernet (GVE) network interfaces are vulnerable to kernel crashes during network interface initialization. The vulnerability allows interrupts to fire before NAPI context is fully initialized, causing kernel panics that can disrupt system availability.
Vulnerability analysis
The root cause is a race condition in the GVE driver's interrupt and NAPI initialization sequence. When requesting interrupts with request_irq(), they are automatically enabled immediately, but the associated NAPI context may not be fully initialized yet. If an interrupt fires during this window, it triggers __napi_poll() on an uninitialized NAPI structure, leading to kernel crashes. The fix uses IRQF_NO_AUTOEN to defer interrupt enablement until after NAPI registration is complete, and explicitly enables/disables interrupts in the NAPI add/remove functions to ensure proper lifecycle coupling.
03Fix Versions
| Branch | Fixed in | Patch commit |
|---|---|---|
| 6.12 | 6.12.64 | f5b7f49bd237 |
| 6.18 | 6.18.4 | 48f927768092 |
| mainline | 6.19 | 3d970eda0034 |