CVE-2024-40993

What it actually does

Missing RCU protection check in ip_set_dereference() during pernet exit when destroying all ipsets allows unsafe dereference in a race condition.

Why it matters to the business

Local denial-of-service risk on Linux systems using ipset, potentially causing kernel instability or crashes during network namespace cleanup or system shutdown; low exploitation probability but relevant for high-availability environments.

How an attack unfolds

A local attacker triggers ipset destruction either via userspace command or during pernet exit and exploits the missing pernet-exit check in rcu_dereference_protected to induce a race condition leading to kernel crash.

How to fix it

Upgrade the Linux kernel to 6.1.96 or later; apply commit 3799d02ae4208af08e81310770d8754863a246a1 from the stable git tree.

How to confirm the fix worked

Confirm kernel version is 6.1.96 or newer; inspect ip_set_dereference() for the added pernet-exit check in rcu_dereference_protected().

Typical attack path

1. Gain local user access on an affected Linux host
2. Issue ipset destroy-all command or trigger network namespace exit
3. Exploit the unprotected rcu_dereference during set teardown to cause denial of service

How to detect it

Review kernel logs (dmesg, /var/log/kern.log) for oops or warnings mentioning ip_set_dereference or suspicious RCU usage during shutdown or netns exit.

What your security team should do

• Apply the kernel fix immediately on internet-facing or critical systems
• Reboot after patching to activate the updated ipset code
• Monitor kernel logs for RCU or ipset warnings during namespace teardown