CVE-2024-39490

What it actually does

Missing release of sk_buff after skb_cow_head failure in seg6_input_core leads to a kernel memory leak when processing IPv6 Segment Routing packets.

Why it matters to the business

Over time, repeated triggering can exhaust kernel memory on affected Linux systems, causing performance degradation, service disruption, or crashes on network devices and servers handling IPv6 traffic; high prevalence in the Linux ecosystem increases exposure across many deployments, requiring prompt patching.

How an attack unfolds

An attacker sends specially crafted IPv6 packets containing a Segment Routing Header that trigger the seg6_input path; when skb_cow_head fails inside seg6_input_core the sk_buff is not freed, gradually leaking memory until the system becomes unstable.

How to fix it

Upgrade the Linux kernel to the fixed commit e8688218e38111ace457509d8f0cad75f79c1a7a or apply the equivalent stable backport that ensures seg6_input_core releases the sk_buff on skb_cow_head failure.

How to confirm the fix worked

Confirm the running kernel contains commit e8688218e38111ace457509d8f0cad75f79c1a7a or later; inspect seg6.c source for the skb release after skb_cow_head error path; test with crafted SRH packets and monitor for absence of leaks via slabinfo or kmemleak.

Typical attack path

1. Send IPv6 packets with SRH to a vulnerable Linux kernel network stack
2. Trigger skb_cow_head failure condition in seg6_input_core
3. Observe repeated memory leaks without sk_buff release
4. Accumulate leaks until kernel memory exhaustion or denial of service

How to detect it

Review kernel logs for repeated seg6_input_core errors or warnings around skb handling; use memory leak detectors such as kmemleak or slabinfo to observe growing allocations in the skbuff_head_cache after processing IPv6 SR packets; correlate with network traffic containing Segment Routing Headers.

What your security team should do

• Prioritize kernel upgrade to the fixed commit across all IPv6-enabled systems
• Monitor memory usage on segment-routing enabled interfaces until patched
• Apply network filtering to drop unexpected SRH packets as a temporary mitigation if immediate patching is not feasible