CVE-2024-45001

What it actually does

The MANA driver passes an improperly aligned alloc_size into napi_build_skb(), causing skb_shinfo(skb) to sit at an unaligned address; on ARM64 this triggers an alignment fault during atomic operations on skb_shinfo(skb)->dataref when certain MTUs (e.g. 4000) are in use, resulting in a kernel panic.

Why it matters to the business

Systems running the affected Linux kernel with the MANA driver on ARM64 hardware can suffer sudden kernel panics and reboots during normal IPv6 receive processing, producing unplanned downtime; the issue has been public for over two years with no known active exploitation or ransomware use.

How an attack unfolds

An attacker or even routine traffic sends IPv6 packets to a MANA interface configured with an MTU that produces an unaligned skb_shinfo; the receive path reaches raw6_local_deliver and later __skb_clone, where the unaligned atomic operation faults and panics the kernel.

How to fix it

Upgrade the Linux kernel to a version containing commit 65f20b174ec0172f2d6bcfd8533ab9c9e7e347fa (or later stable backport) so that alloc_size is properly aligned before calling napi_build_skb; Crossplane users should deploy versions 1.9.2, 1.10.3 or 1.11.2 that consume the fixed kernel.

How to confirm the fix worked

Confirm the running kernel contains commit 65f20b174ec0172f2d6bcfd8533ab9c9e7e347fa; verify MTU 4000 traffic no longer triggers the alignment-fault panic on ARM64 MANA interfaces; inspect dmesg for absence of the ESR 0x96000021 and "alignment fault" messages.

Typical attack path

1. Attacker or benign traffic delivers IPv6 frames to a MANA interface on ARM64
2. Driver allocates RX buffer whose size is not aligned for skb_shinfo
3. napi_build_skb creates an skb with misaligned shinfo
4. ip6 input path calls skb_clone
5. Atomic update of dataref hits alignment fault and kernel panics

How to detect it

Search kernel logs and crash dumps for the strings "Unable to handle kernel paging request", "ESR = 0x0000000096000021", "alignment fault", and the call trace containing napi_build_skb, __skb_clone, raw6_local_deliver and ip6_input; correlate with MANA interface activity and MTU 4000 configurations.

• Unable to handle kernel paging request at virtual address ffff000129ba5cce
• ESR = 0x0000000096000021
• FSC = 0x21: alignment fault
• __skb_clone+0xfc/0x198
• skb_shinfo(skb)->dataref

What your security team should do

• Prioritize kernel upgrade on all ARM64 systems using the MANA driver
• Apply the fixed kernel versions listed for both the upstream tree and Crossplane packages
• Monitor for the specific panic signature until patches are deployed
• Test MTU 4000 receive paths in a lab environment after patching