CVE-2024-26587

What it actually does

NULL pointer dereference in mock_phc_destroy when a netdevsim device with virtual functions is destroyed, because PHC initialization is skipped on VFs but destruction is not.

Why it matters to the business

Kernel panic or system crash on Linux hosts that use the netdevsim driver for network device simulation, leading to denial of service and potential loss of availability during device teardown or driver unload.

How an attack unfolds

An attacker with local access triggers the bug by creating a netdevsim device, instantiating virtual functions, then removing the device or unloading the driver, causing the kernel to dereference a null pointer inside mock_phc_destroy during cleanup.

How to fix it

Update the Linux kernel to a version containing commit 08aca65997fb6f233066883b1f1e653bcb1f26ca or later; rebuild and reboot with the patched kernel. Disable or avoid use of netdevsim in production environments until patched.

How to confirm the fix worked

Confirm the running kernel contains commit 08aca65997fb6f233066883b1f1e653bcb1f26ca by checking /proc/version or git log; attempt to create and destroy a netdevsim device with VFs and verify no NULL pointer dereference occurs.

Typical attack path

1. Load the netdevsim kernel module
2. Use devlink or sysfs to create a netdevsim device marked as a PF
3. Instantiate one or more virtual functions on that device
4. Trigger device removal or driver unload via del_device_store or nsim_drv_remove
5. Kernel executes nsim_destroy which calls mock_phc_destroy on an uninitialized PHC

How to detect it

Search kernel logs (dmesg, /var/log/kern.log, journalctl) for the exact BUG message and stack trace referencing mock_phc_destroy, nsim_destroy, and netdevsim module; look for preceding devlink or sysfs operations that create and delete netdevsim devices with VFs.

• BUG: kernel NULL pointer dereference, address: 00000000000000b8
• RIP: 0010:mock_phc_destroy+0xd/0x30
• nsim_destroy+0x4a/0x70 [netdevsim]
• __nsim_dev_port_del+0x47/0x70 [netdevsim]
• del_device_store+0x11a/0x1a0 [netdevsim]

What your security team should do

• Apply the kernel patch containing commit 08aca65997fb6f233066883b1f1e653bcb1f26ca immediately on all affected systems
• Restrict local access to devlink and netdevsim sysfs interfaces until patched
• Monitor for kernel oops involving mock_phc_destroy in production logs
• Remove netdevsim from any production kernel configurations