CVE-2024-26723

What it actually does

NULL pointer dereference in the lan966x driver when iterating over unprobed ports during LAG interface addition, resulting in kernel crash.

Why it matters to the business

System instability or denial of service on affected Linux kernels using lan966x hardware, potentially disrupting network operations until patched.

How an attack unfolds

An attacker with local privileges creates a bond interface and enslaves a lan966x port, causing the driver to traverse NULL port pointers and crash the kernel.

How to fix it

Upgrade the Linux kernel to a version containing commit b9357489c46c7a43999964628db8b47d3a1f8672 or later; apply the NULL pointer check before accessing ports.

How to confirm the fix worked

Verify kernel version includes the fix commit; reproduce the bond creation steps in a test environment and confirm no crash occurs.

Typical attack path

1. Create a bond interface using ip link add
2. Set a lan966x interface as master of the bond
3. Trigger port iteration logic that encounters uninitialized NULL pointers

How to detect it

Review kernel logs for oops or panic messages referencing lan966x and port iteration; look for crash dumps triggered during network interface configuration.

• lan966x.*NULL pointer
• kernel:.*bond.*lan966x crash

What your security team should do

• Prioritize kernel updates for systems using lan966x drivers
• Monitor for kernel oops or panics involving lan966x
• Restrict local user access where possible until patched