CVE-2024-35890

What it actually does

The flaw removes the skb destructor during GRO fraglist processing in skb_gro_receive_list (and similarly in skb_gro_receive) but leaves the socket reference intact, so later skb_segment_list reuse or skb_orphan calls in ip6_rcv_core trigger a kernel BUG instead of cleanly orphaning the skb.

Why it matters to the business

Network-intensive Linux systems can experience sudden kernel panics and reboots when handling GRO traffic, causing denial of service and service disruption; the issue has been present for years and affects the stable kernel tree widely used in servers, appliances, and Android devices.

How an attack unfolds

An attacker sends network packets that undergo GRO aggregation with fraglist; when the aggregated skb is later segmented in skb_segment_list and passed through the IPv6 receive path, the stale socket reference causes skb_orphan to BUG, crashing the kernel. No public exploits or ransomware use are known.

How to fix it

Update the Linux kernel to a version containing commit d225b0ac96dc40d7e8ae2bc227eb2c56e130975f or later; rebuild and reboot with the fixed kernel. Disable GRO on affected interfaces as a temporary mitigation if patching is delayed.

How to confirm the fix worked

Confirm the running kernel contains commit d225b0ac96dc40d7e8ae2bc227eb2c56e130975f (via uname -r or git describe); reproduce GRO traffic and verify absence of the skb_orphan BUG in dmesg; run packet capture and GRO segmentation tests.

Typical attack path

1. Send crafted or normal IPv6 traffic that triggers GRO fraglist aggregation
2. Force or wait for GRO flush/segmentation in skb_segment_list
3. skb proceeds through ipv6_list_rcv and ip6_rcv_core where skb_orphan is called
4. Kernel hits BUG at skbuff.h:3131 and panics

How to detect it

Search kernel logs (dmesg, /var/log/kern.log, journalctl) for the exact BUG line 'kernel BUG at include/linux/skbuff.h:3131!' and the call trace containing ip6_rcv_core, ipv6_list_rcv, and gro_cell_poll; correlate with periods of high GRO activity or fraglist usage.

• kernel BUG at include/linux/skbuff.h:3131!
• RIP: 0010:ip6_rcv_core+0x11bc/0x19a0
• skb_orphan
• gro_cell_poll

What your security team should do

• Apply the fixed kernel commit immediately on all exposed systems
• Prioritize patching Internet-facing and high-traffic servers first
• Monitor kernel logs for skb_orphan BUG signatures until all instances are updated
• Consider disabling GRO temporarily on unpatchable systems