CVE-2024-26596

What it actually does

The flaw performs an unconditional netdev_priv() dereference on every NETDEV_CHANGEUPPER and NETDEV_PRECHANGEUPPER notifier event, reading 8 bytes at offset 16 of a struct dsa_user_priv that does not exist on non-DSA netdevices such as dummy interfaces (priv size 0), resulting in a slab-out-of-bounds read.

Why it matters to the business

Systems may experience kernel oops or crashes during routine network configuration changes involving VLANs or upper devices, leading to unplanned downtime and requiring reboots; widespread kernel deployments increase exposure surface.

How an attack unfolds

An attacker with local access creates a dummy interface, attaches a VLAN, and triggers NETDEV_PRECHANGEUPPER events that reach dsa_user_prechangeupper without a prior DSA type check, causing the invalid dereference and kernel fault.

How to fix it

Update the Linux kernel to the fixed commit 9e9953f5e4d6d11a9dad56fdee307bb923302809 or later stable releases containing the corrected dsa_user_to_port logic that performs the type check before dereference.

How to confirm the fix worked

Confirm the running kernel contains commit 9e9953f5e4d6d11a9dad56fdee307bb923302809; reproduce the dummy+VLAN setup and verify absence of KASAN slab-out-of-bounds reports in dmesg.

Typical attack path

1. Obtain local shell access on a Linux system
2. Execute ip link commands to add a dummy interface and a VLAN upper device
3. Trigger netdevice notifier chain via link addition or configuration change
4. Cause slab-out-of-bounds read in dsa_user_netdevice_event handler
5. Result in kernel oops and potential denial of service

How to detect it

Review kernel logs for KASAN slab-out-of-bounds messages referencing dsa_user_prechangeupper or dsa_user_netdevice_event during netdevice notifier activity; correlate with process activity creating dummy or VLAN interfaces.

• BUG: KASAN: slab-out-of-bounds in dsa_user_prechangeupper
• dsa_user_netdevice_event
• Read of size 8 at addr .* by task ip

What your security team should do

• Prioritize kernel upgrades on all production and exposed systems within standard change windows
• Monitor vendor and distribution advisories for backported fixes
• Restrict unprivileged local users from performing arbitrary network interface configuration where feasible
• Enable kernel hardening features such as KASAN or lockdown mode in test environments to surface similar issues earlier