CVE-2024-26735

What it actually does

Incorrect ordering of pernet operations registration relative to generic netlink family registration in the IPv6 SR subsystem creates a window for use-after-free and null pointer dereference during module load/unload or namespace operations.

Why it matters to the business

Linux-based systems and devices may experience kernel panics, crashes, or potential local privilege escalation affecting servers, containers, embedded systems, and Android devices that rely on the affected kernel versions.

How an attack unfolds

An attacker with local access triggers the race condition by loading or unloading the IPv6 SR module or manipulating network namespaces, leading to dereference of freed memory or null pointers that can be leveraged for code execution or denial of service.

How to fix it

Update the Linux kernel to the fixed commit 953f42934533c151f440cd32390044d2396b87aa or later stable releases that enforce pernet operations registration before generic netlink family registration.

How to confirm the fix worked

Verify kernel source or binary contains the corrected registration order; test module load/unload sequences and namespace creation under IPv6 SR to confirm absence of crashes or dereferences.

Typical attack path

1. Obtain local access to a vulnerable Linux system
2. Trigger IPv6 SR module initialization or pernet operations in a specific sequence
3. Exploit resulting use-after-free or null dereference to corrupt kernel memory
4. Escalate privileges or cause system instability

How to detect it

Review kernel logs for oops, panics, or warnings mentioning sr or netlink during module or namespace operations; correlate with process activity that manipulates IPv6 segment routing.

What your security team should do

• Prioritize kernel upgrades on all exposed Linux systems within standard patch windows
• Monitor for kernel oops or panic logs related to IPv6 SR and netlink
• Apply compensating controls such as module blacklisting where upgrades are delayed