CVE-2024-36954

What it actually does

Possible memory leak in tipc_buf_append when __skb_linearize fails to free the skb on error, leaving the buffer reference un-cleared.

Why it matters to the business

Over time, repeated failures in TIPC networking paths can exhaust kernel memory on Linux systems, causing performance degradation or crashes in environments relying on the TIPC protocol.

How an attack unfolds

An attacker would need to trigger repeated TIPC buffer append operations that cause __skb_linearize to fail, gradually leaking skb structures until memory pressure leads to denial of service; no public exploits or targeted campaigns are known for this specific flaw.

How to fix it

Update the Linux kernel to a version containing commit b562e44f507e863c6792946e4e1b1449fbbac85d or later; rebuild and deploy the updated kernel image across all affected systems.

How to confirm the fix worked

Confirm the presence of commit b562e44f507e863c6792946e4e1b1449fbbac85d in the kernel source tree or verify the fix by inspecting that '*buf = NULL' occurs after the __skb_linearize call in tipc_buf_append.

Typical attack path

1. Identify or create conditions that invoke tipc_buf_append with a sk_buff requiring linearization
2. Force __skb_linearize to return failure (e.g., via memory pressure or malformed packets)
3. Observe that the original skb is not freed because *buf is cleared before the call
4. Repeat to accumulate leaked memory until system impact

How to detect it

Review kernel logs for repeated TIPC-related allocation failures or OOM killer activity correlated with TIPC traffic; examine memory leak detectors such as kmemleak reports for skb_buffer objects originating from tipc code.

What your security team should do

• Prioritize kernel updates on systems using TIPC (common in clustered or telecom environments)
• Monitor memory usage trends on TIPC-enabled hosts as an interim indicator
• Apply the fix during the next scheduled maintenance window if not already deployed