CVE-2023-3022

What it actually does

Inconsistent handling of arg.result in fib6_rule_lookup where the field sometimes contains rt6_info and other times fib6_info, with downstream code unconditionally expecting rt6_info, resulting in a type confusion that triggers a kernel panic in fib6_rule_suppress.

Why it matters to the business

Unexpected crashes on Linux systems using IPv6 can interrupt services, cause data corruption, and require manual reboots or recovery, increasing operational overhead across large fleets.

How an attack unfolds

A local attacker with low privileges crafts IPv6 routing rule configurations that exercise the inconsistent result handling path in fib6_rule_lookup, forcing the kernel into fib6_rule_suppress with an unexpected structure type and inducing a panic.

How to fix it

Upgrade the Linux kernel to a version that ensures consistent typing of arg.result throughout the IPv6 rule lookup and suppression logic; apply all subsequent stable updates that address IPv6 FIB handling.

How to confirm the fix worked

Verify the running kernel contains the corrected fib6_rule_lookup implementation; inspect kernel source or changelog entries for consistent rt6_info/fib6_info handling; test IPv6 rule operations under load to confirm absence of panics.

Typical attack path

1. Obtain local unprivileged access on a Linux host
2. Configure or trigger IPv6 FIB rules that invoke fib6_rule_lookup
3. Reach the code path in fib6_rule_suppress expecting rt6_info
4. Trigger kernel panic via type mismatch

How to detect it

Review kernel logs (dmesg, /var/log/kern.log, journalctl) for panic messages referencing fib6_rule_suppress, fib6_rule_lookup, rt6_info or fib6_info; correlate with IPv6 route configuration changes or user-initiated network rule modifications.

What your security team should do

• Apply current Linux kernel security updates as soon as they are available for each distribution
• Monitor kernel logs for IPv6-related panic signatures on all production systems
• Limit local user access on systems where IPv6 routing manipulation is unnecessary
• Include kernel version checks in vulnerability scanning and asset inventory processes