CVE-2024-36929

What it actually does

The flaw allows skb_copy or skb_copy_expand to operate on SKB_GSO_FRAGLIST skbs, which must not be linearized; this produces an invalid skb that later triggers a crash inside skb_gso_segment.

Why it matters to the business

Local users or processes can trigger a kernel crash, causing denial of service on affected Linux systems; the large number of downstream kernel dependents increases the scope of potential operational disruption.

How an attack unfolds

An attacker with local access crafts or manipulates network packets that result in an SKB_GSO_FRAGLIST skb, then invokes skb_copy or skb_copy_expand on it (directly or via a subsystem), causing the kernel to linearize the skb and subsequently crash when skb_gso_segment is called.

How to fix it

Upgrade the Linux kernel to the commit faa83a7797f06cefed86731ba4baa3b4dfdc06c1 or apply the equivalent stable-branch patch that adds the fraglist rejection check in skb_copy and skb_copy_expand.

How to confirm the fix worked

Confirm the running kernel contains commit faa83a7797f06cefed86731ba4baa3b4dfdc06c1; test that skb_copy and skb_copy_expand now return NULL for SKB_GSO_FRAGLIST skbs without crashing; monitor for absence of related kernel oops messages.

Typical attack path

1. Obtain local code execution or user privileges on a vulnerable Linux kernel
2. Generate or receive network traffic that produces an SKB_GSO_FRAGLIST skb
3. Trigger skb_copy or skb_copy_expand on the fraglist skb through a network subsystem or API
4. Force a subsequent call to skb_gso_segment on the now-invalid linearized skb
5. Crash the kernel, achieving denial of service

How to detect it

Search kernel logs for oops or panic messages referencing skb_copy, skb_copy_expand, or skb_gso_segment on fraglist GSO skbs; inspect auditd or syscall logs for unusual invocations of network copy routines by untrusted processes.

What your security team should do

• Prioritize kernel upgrade to the fixed commit on all affected systems before the next maintenance window
• Restrict untrusted local code execution where possible until patches are applied
• Update kernel packages in build pipelines and CI systems to the patched version
• Review and test any custom networking or GSO-related modules for compatibility after the update