CVE-2024-44985

What it actually does

Use-after-free in ip6_xmit() when skb_expand_head() returns NULL, allowing the skb and associated dst/idev to be freed without RCU protection.

Why it matters to the business

Potential kernel crashes, privilege escalation, or remote code execution on Linux systems handling IPv6 traffic, affecting servers, containers, and embedded devices with high ecosystem prevalence.

How an attack unfolds

An attacker sends crafted IPv6 packets that trigger skb_expand_head() failure in ip6_xmit(), racing the freed dst/idev structures before RCU synchronization; listed threat actors in 2024 zero-day campaigns could chain this for kernel-level access.

How to fix it

Update the Linux kernel to the fixed commit b3a3d5333c13a1be57499581eab4a8fc94d57f36 or later stable releases containing this patch; rebuild and reboot affected systems.

How to confirm the fix worked

Verify kernel source contains commit b3a3d5333c13a1be57499581eab4a8fc94d57f36, confirm ip6_xmit() uses rcu_read_lock() around skb_expand_head(), and test with IPv6 traffic generators.

Typical attack path

1. Send malicious IPv6 packets to a vulnerable Linux host
2. Force skb_expand_head() to fail and free the skb
3. Access freed dst/idev structures before RCU grace period
4. Achieve use-after-free for memory corruption or control-flow hijack

How to detect it

Search kernel logs and audit trails for oops/panic messages mentioning ip6_xmit or skb_expand_head failures; inspect RCU-related warnings and memory corruption artifacts post-2024-09-04.

• ip6_xmit
• skb_expand_head
• rcu_read_lock

What your security team should do

• Prioritize patching Linux kernels on all IPv6-enabled systems within the next 30 days
• Monitor for kernel oops or panic logs related to ip6_xmit
• Apply network segmentation to limit IPv6 exposure until patched
• Review downstream dependents for inherited kernel images