CVE-2024-27390

What it actually does

Unnecessary synchronize_net() barrier in ipv6_mc_down() during IPv6 multicast teardown creates a window for races in network stack shutdown under load, resulting in high availability impact via delays or KASAN-detected issues between 200us and 5ms.

Why it matters to the business

Systems handling IPv6 multicast traffic may experience instability or degraded network performance; widespread Linux kernel exposure increases operational risk for networked services, though low exploit likelihood reduces immediate urgency.

How an attack unfolds

A local attacker triggers IPv6 multicast query or report events while the interface is brought down, leveraging the extraneous barrier and race condition to disrupt network stack operations.

How to fix it

Update the Linux kernel to a version containing commit 9d159d6637ccce25f879d662a480541ef4ba3a50 or later; Debian packages of festival should be upgraded to 1.96~beta-6 or newer where applicable.

How to confirm the fix worked

Verify kernel source or package version includes the referenced commit; confirm absence of the synchronize_net() call in ipv6_mc_down() and test under load for expected multicast behavior.

Typical attack path

1. Obtain local access on an affected Linux system
2. Trigger IPv6 multicast events under system load
3. Initiate interface teardown via ipv6_mc_down()
4. Exploit resulting race to cause denial of service

How to detect it

Review system logs for unusual IPv6 multicast errors or KASAN reports during interface down events; examine kernel crash dumps or performance traces around synchronize_net calls in network teardown paths.

What your security team should do

• Prioritize kernel updates on all IPv6-enabled systems within standard patch cycles
• Monitor for new EPSS increases or KEV inclusion
• Review network configurations to minimize unnecessary multicast usage where feasible