CVE-2024-26665

What it actually does

Out-of-bounds memory read in do_csum when skb_tunnel_check_pmtu processes a non-linear skb while constructing an IPv6 PMTU error for tunnel protocols such as VXLAN; csum_partial cannot handle fragmented buffers, triggering slab-out-of-bounds access.

Why it matters to the business

Production Linux systems using tunnel interfaces may suffer unexpected kernel crashes and service outages when handling specific IPv6 traffic patterns, increasing downtime and operational recovery costs.

How an attack unfolds

An attacker sends crafted IPv6 packets that force a tunnel device to generate a PMTU error; if the skb is non-linear the vulnerable checksum path reads past allocated slab memory, resulting in a kernel fault or potential limited information leak.

How to fix it

Upgrade the Linux kernel to a version containing commit e77bf828f1ca1c47fcff58bdc26b60a9d3dfbe1d (or the corresponding stable backport) which replaces csum_partial with skb_checksum.

How to confirm the fix worked

Confirm the running kernel contains the referenced commit or later; exercise VXLAN/IPv6 PMTU workloads and verify absence of KASAN slab-out-of-bounds reports in dmesg.

Typical attack path

1. Craft IPv6 packets targeting a VXLAN or similar tunnel endpoint
2. Trigger PMTU discovery error handling in the kernel tunnel stack
3. Ensure the skb is delivered in a non-linear state to skb_tunnel_check_pmtu
4. Cause do_csum to perform an out-of-bounds read

How to detect it

Search kernel logs and dmesg for KASAN slab-out-of-bounds reports referencing do_csum, skb_tunnel_check_pmtu, or vxlan_xmit; correlate with netperf or high-volume tunnel traffic preceding the crash.

• BUG: KASAN: slab-out-of-bounds in do_csum
• skb_tunnel_check_pmtu+0xeb9/0x3280
• vxlan_xmit_one+0x14c2/0x4080
• Read of size 4 at addr ffff888

What your security team should do

• Apply the kernel fix to all systems exposing tunnel interfaces within the next maintenance window
• Prioritize hosts with high network throughput or public-facing tunnel endpoints
• Enable kernel panic-on-oops and central log collection for rapid detection of related crashes