CVE-2024-40961

What it actually does

NULL pointer dereference in fib6_nh_init() when in6_dev_get() returns NULL during IPv6 gateway validation and route checks, resulting in a general protection fault and kernel crash.

Why it matters to the business

Local denial-of-service crashes on Linux systems processing certain IPv6 routes or interface configurations, potentially disrupting network services and requiring reboots; widespread kernel exposure increases operational risk for servers and devices running affected versions.

How an attack unfolds

An attacker with local access issues IPv6 route ioctl commands that reach ip6_route_info_create and fib6_nh_init; the code path calls in6_dev_get which can return NULL, triggering a null-pointer dereference and kernel oops when dereferencing fields in the missing device structure.

How to fix it

Update the Linux kernel to the fixed commit 3200ffeec4d59aad5bc9ca75d2c1fae47c0aeade or later stable releases containing the patch; rebuild and deploy updated kernels across affected systems.

How to confirm the fix worked

Verify kernel source contains the commit 3200ffeec4d59aad5bc9ca75d2c1fae47c0aeade or check running kernel version against patched releases; attempt reproduction with syzbot-style IPv6 route ioctls on test systems to confirm absence of crash.

Typical attack path

1. Obtain local user access on a Linux system
2. Create or configure network interfaces with specific IPv6 settings
3. Invoke ipv6_route_ioctl or equivalent route-add operations via socket ioctl
4. Trigger ip6_route_check_nh and in6_dev_get returning NULL
5. Cause kernel panic via dereference in fib6_nh_init

How to detect it

Search kernel logs, dmesg, and syslog for oops/panic entries containing fib6_nh_init, ip6_route_info_create, null-ptr-deref, or KASAN reports referencing net/ipv6/route.c around line 3606; correlate with recent IPv6 route ioctl activity from untrusted processes.

• fib6_nh_init+0x640/0x2160
• KASAN: null-ptr-deref in range [0x00000000000005e0-0x00000000000005e7]
• ip6_route_info_create+0x99e/0x12b0
• general protection fault, probably for non-canonical address 0xdffffc00000000bc

What your security team should do

• Prioritize kernel updates to the listed fixed commit on all production Linux hosts
• Monitor kernel logs for null-ptr-deref and fib6_nh_init oops messages
• Restrict unprivileged IPv6 route configuration where feasible via capabilities or namespaces
• Test patched kernels in staging before broad rollout due to routing impact