CVE-2024-41081

What it actually does

Race condition in ila_output() where dst_cache helpers are invoked without BH disabled, allowing softirq interruption and re-entry from process context under rcu_read_lock to corrupt dst_cache data structures.

Why it matters to the business

Linux systems using ILA tunneling may experience kernel instability, crashes, or unexpected network behavior, increasing operational risk for organizations reliant on affected kernels especially given broad Linux ecosystem prevalence.

How an attack unfolds

An attacker triggers lwtunnel_output() paths calling ila_output() in process context, relies on softirq interruption to re-enter the function concurrently, and corrupts dst_cache structures; listed threat actor campaigns highlight ongoing focus on Linux kernel flaws for espionage or financial gain though this specific issue lacks confirmed exploitation.

How to fix it

Upgrade Linux kernel to commit 7435bd2f84a25aba607030237261b3795ba782da or later stable versions containing the local_bh_disable() fix in ila_output().

How to confirm the fix worked

Confirm kernel source contains the local_bh_disable() change around ila_output() or verify running kernel version is at or above the fixed commit; test under load with RCU and softirq activity.

Typical attack path

1. Identify systems running vulnerable Linux kernels with ILA/lwtunnel enabled
2. Trigger network paths invoking ila_output() from process context
3. Force softirq to interrupt and re-enter the function
4. Corrupt dst_cache structures leading to crash or further exploitation

How to detect it

Review kernel logs for panics or warnings involving dst_cache corruption, ila_output re-entry, or softirq-related races; correlate with network traffic triggering lwtunnel paths.

What your security team should do

• Apply the referenced kernel commit or distro backport immediately on all affected systems
• Monitor for kernel stability issues in ILA-enabled environments
• Review network configurations to minimize unnecessary lwtunnel/ILA usage until patched
• Track EPSS and KEV updates for any change in exploit likelihood