CVE-2024-40983

What it actually does

Missing skb destination refcount before asynchronous TIPC decryption allows the dst entry to be freed while still referenced inside the crypto completion handler, resulting in use-after-free.

Why it matters to the business

Systems running affected Linux kernels that use the TIPC protocol can experience kernel panics or denial of service; widespread kernel deployments increase exposure across servers and embedded devices.

How an attack unfolds

An attacker sends specially crafted TIPC packets that reach the decryption path; the asynchronous crypto worker returns after the RCU grace period, dereferencing a freed dst and triggering the crash or allowing further memory corruption.

How to fix it

Apply the upstream fix commit 3eb1b39627892c4e26cb0162b75725aa5fcc60c8 or later stable kernels that include skb_dst_force() before TIPC decryption; rebuild and reboot affected systems.

How to confirm the fix worked

Verify the running kernel contains commit 3eb1b39627892c4e26cb0162b75725aa5fcc60c8; confirm absence of the dst.h warning when TIPC traffic is decrypted; test with reproducer packets that previously triggered the path.

Typical attack path

1. Send TIPC multicast or unicast packets that require AEAD decryption
2. Trigger tipc_aead_decrypt_done via cryptd workqueue
3. Race the async completion against dst release to hit the freed pointer in tipc_sk_rcv
4. Cause kernel warning or panic; attempt to leverage UAF for code execution if conditions allow

How to detect it

Search kernel logs and crash dumps for the exact warning at include/net/dst.h:337 inside tipc_sk_rcv, stack traces containing tipc_aead_decrypt_done and cryptd_queue_worker, and any TIPC receive paths under high crypto load.

• WARNING: include/net/dst.h:337 tipc_sk_rcv
• tipc_aead_decrypt_done
• cryptd_queue_worker
• tipc_sk_mcast_rcv
• tipc_rcv

What your security team should do

• Patch Linux kernels to the fixed commit immediately on all systems exposing TIPC
• Disable TIPC on hosts that do not require it
• Monitor kernel logs for tipc and cryptd stack traces
• Prioritize updates on high-value or internet-facing Linux servers