CVE-2024-36903

What it actually does

Potential uninitialized value access in __ip6_make_skb() caused by a race condition when testing the HDRINCL socket option instead of the FLOWI_FLAG_KNOWN_NH flag on fl6->flowi6_flags.

Why it matters to the business

May trigger kernel crashes or memory information leaks during IPv6 packet processing, leading to service disruptions on affected Linux systems.

How an attack unfolds

An attacker triggers concurrent IPv6 socket operations and packet transmission to exploit the race condition, causing the kernel to use uninitialized data in skb construction.

How to fix it

Update the Linux kernel to the fixed commit 8fe28cb58bcb235034b64cbbb7550a8a43fd88be or any later version containing the patch.

How to confirm the fix worked

Confirm the fix commit is present in the kernel source tree or verify updated kernel packages have been installed and rebooted.

Typical attack path

1. Enable IPv6 networking on a vulnerable Linux kernel
2. Perform concurrent socket option changes and IPv6 packet sends to hit the race
3. Trigger uninit-value access resulting in panic or information disclosure

How to detect it

Review kernel logs and crash dumps for uninitialized value warnings or panics originating from __ip6_make_skb or related IPv6 stack functions.

What your security team should do

• Apply the kernel update containing commit 8fe28cb58bcb235034b64cbbb7550a8a43fd88be as soon as possible
• Monitor kernel logs for IPv6-related panics or warnings
• Limit exposure by disabling IPv6 on systems where it is not required