CVE-2024-26634

What it actually does

The flaw triggers a kernel BUG() in net/core/dev.c during namespace teardown when physical interfaces moved out of init_net have conflicting alternative names that are not discarded, causing a crash instead of clean removal.

Why it matters to the business

Systems may experience unexpected kernel crashes during network namespace cleanup or container teardown, leading to downtime, loss of connectivity, and potential data corruption in environments using advanced networking features like network namespaces.

How an attack unfolds

An attacker with the ability to create and manipulate network namespaces and move physical interfaces between them can arrange for conflicting alternative names to exist; when the namespace is removed the kernel hits the BUG() and crashes, resulting in denial of service. No named threat actors are known to be exploiting this specific issue.

How to fix it

Upgrade the Linux kernel to version 6.1.76 or later, or apply the fix identified by commit a2232f29bf52c24f827865b3c90829c44b6c695b. For AlmaLinux 8 systems also update cockpit-machines, cockpit-packagekit, cockpit-pcp and cockpit-storaged to 251.1-1.el8 or newer. Reboot after kernel updates.

How to confirm the fix worked

Confirm the running kernel version is at least 6.1.76 and that the git commit a2232f29bf52c24f827865b3c90829c44b6c695b is present; attempt namespace creation, interface move, and removal in a test environment to verify the BUG() no longer occurs.

Typical attack path

1. Obtain privileges sufficient to create network namespaces and move interfaces
2. Move a physical interface out of init_net into a new namespace while ensuring an altname conflict exists
3. Trigger removal of the namespace containing the interface
4. Observe kernel BUG() and resulting crash or panic

How to detect it

Search kernel logs (dmesg, /var/log/kern.log, journalctl) for the exact BUG() string at net/core/dev.c:11520 or messages mentioning conflicting altnames during namespace removal; correlate with processes that create or destroy network namespaces such as container runtimes.

What your security team should do

• Prioritize kernel updates on all systems using network namespaces or containers within the next maintenance window
• Monitor for kernel oops or BUG() messages referencing net/core/dev.c:11520
• Test namespace teardown procedures after patching to ensure stability
• Review container runtime and orchestration configurations that rely on network namespace isolation