CVE-2024-35981 is a vulnerability in the Linux kernel's virtio_net driver, specifically related to the handling of Receive Side Scaling (RSS) options in virtualized environments using QEMU with virtio network devices. The issue arises when an RSS key is not supported by the device but the kernel attempts to set RSS options regardless. When the command to set the RSS hash function (e.g., using `ethtool -X eth0 hfunc toeplitz`) is issued inside a QEMU virtual machine with a virtio_net interface, the kernel calls a sequence of functions culminating in virtnet_commit_rss_command(). This function prepares a scatter-gather buffer for the RSS command, but if the RSS key size is zero (indicating the feature is unsupported), the last scatter-gather entry is zeroed out, resulting in a zero-length buffer being passed to QEMU. QEMU's virtqueue_map_desc() function rejects zero-sized buffers, marking the device as broken (`vdev->broken = true`) and ceasing to respond to the kernel. However, the kernel's virtio driver does not check QEMU's broken device flag and waits indefinitely for a response that never arrives, entering an infinite loop. This effectively causes the entire virtual machine to hang or become unresponsive. The vulnerability is fixed by ensuring that RSS commands are not sent if the device does not support the feature, preventing the zero-length buffer scenario and the subsequent infinite loop. This is a denial-of-service (DoS) vulnerability affecting Linux kernels running as guests in QEMU virtual machines using virtio_net devices when RSS is misconfigured or unsupported.

For European organizations relying on Linux-based virtual machines running under QEMU with virtio_net network interfaces, this vulnerability can lead to complete VM hangs or crashes when RSS settings are manipulated or misconfigured. This can disrupt critical services hosted in virtualized environments, including cloud infrastructure, private data centers, and development/testing platforms. The infinite loop in the kernel can cause resource exhaustion and require manual intervention to recover the VM, leading to downtime and potential loss of availability for business-critical applications. Since the issue is triggered by a specific ethtool command, it could be exploited by a malicious insider or an attacker with guest VM access to cause denial of service. This is particularly impactful for European organizations with large-scale virtualization deployments in sectors such as finance, telecommunications, and government, where uptime and service continuity are paramount. Additionally, the vulnerability may complicate automated network configuration management and monitoring tools that use ethtool to adjust RSS settings, potentially causing unintended outages.

1. Apply Linux kernel patches or updates that address CVE-2024-35981 as soon as they become available from trusted Linux distributions or kernel maintainers. 2. Avoid sending RSS configuration commands (e.g., via ethtool) to virtio_net devices in QEMU guests unless the feature is explicitly supported by the device. 3. Implement strict access controls and monitoring on guest VMs to prevent unauthorized users from executing commands that modify network device settings. 4. In environments where patching is delayed, consider disabling RSS configuration changes or restricting ethtool usage within VMs to trusted administrators only. 5. Monitor VM logs and QEMU device states for signs of virtio device failures or hangs, enabling rapid detection and recovery. 6. Test network configuration management tools in isolated environments to ensure they do not inadvertently trigger this issue. 7. Coordinate with virtualization platform vendors to ensure hypervisor and guest tools are updated to handle virtio device feature negotiation correctly.