CVE-2024-39489

What it actually does

seg6_hmac_init_algo performs partial allocations of memory and crypto tfms before an allocation failure occurs and returns without releasing prior allocations, resulting in a memory leak; seg6_hmac_exit was updated to free only when actually allocated.

Why it matters to the business

Systems using IPv6 segment routing with HMAC may experience gradual memory exhaustion leading to degraded performance or denial of service over time, especially in long-running kernel environments with high prevalence of Linux kernel deployments.

How an attack unfolds

An attacker with local access triggers repeated calls to seg6_hmac_init_algo under conditions that cause allocation failures after partial success, leaking memory and crypto transforms with each invocation until system resources are depleted.

How to fix it

Upgrade the Linux kernel to a version containing commit afd5730969aec960a2fee4e5ee839a6014643976 or later; rebuild and reboot with the patched kernel; apply vendor-supplied updates for affected distributions.

How to confirm the fix worked

Confirm the running kernel contains commit afd5730969aec960a2fee4e5ee839a6014643976 or equivalent backport; inspect seg6_hmac_init_algo and seg6_hmac_exit source for the corrected cleanup logic; verify no memory growth under repeated init/failure test conditions.

Typical attack path

1. Obtain local user access on a Linux system
2. Load or exercise IPv6 SR HMAC initialization paths
3. Induce allocation failures after partial success in seg6_hmac_init_algo
4. Repeat to accumulate unreleased memory and tfms
5. Monitor for eventual memory pressure or OOM conditions

How to detect it

Review kernel logs and memory statistics for unexpected growth tied to IPv6 SR HMAC usage; examine process or module activity involving seg6_hmac functions; no post-exploitation artifacts are directly observable beyond resource exhaustion patterns.

What your security team should do

• Prioritize kernel upgrades to the fixed commit within standard change windows
• Monitor memory usage on systems exposing IPv6 SR features
• Restrict local access and module loading where SR HMAC is not required
• Review downstream dependent packages for coordinated updates