CVE-2024-46754

What it actually does

Allows bpf_test_run() to invoke LWT_SEG6LOCAL BPF ops without first calling input_action_end_bpf(), leaving the per-CPU seg6_bpf_srh_states::srh uninitialized so subsequent BPF functions dereference invalid state.

Why it matters to the business

Systems that rely on IPv6 segment routing combined with custom BPF programs can experience kernel crashes or unpredictable behavior, disrupting network services and requiring emergency patching across Linux fleets.

How an attack unfolds

An attacker with local access loads or triggers a test invocation of a BPF_PROG_TYPE_LWT_SEG6LOCAL program; because the required per-CPU state is never populated in the test path, the kernel reads uninitialized memory, enabling denial-of-service or limited information disclosure.

How to fix it

Upgrade the Linux kernel to commit 9cd15511de7c619bbd0f54bb3f28e6e720ded5d6 or later; for any dependent packages such as weave-gitops update to version 0.8.1-rc.6 or newer that incorporates the corrected kernel.

How to confirm the fix worked

Confirm the running kernel contains commit 9cd15511de7c or a backport; attempt to load and test-run a LWT_SEG6LOCAL program and verify the operation is now rejected rather than executing with uninitialized state.

Typical attack path

1. Obtain local execution or CAP_BPF privileges on a vulnerable kernel
2. Prepare a minimal BPF program of type LWT_SEG6LOCAL
3. Invoke bpf_test_run() directly on the program
4. Trigger dereference of the uninitialized seg6_bpf_srh_states::srh variable
5. Cause kernel oops, panic, or information leak

How to detect it

Review kernel logs for oops or panic messages referencing seg6_bpf_srh_states or lwt_seg6local_prog_ops; search auditd or eBPF telemetry for unexpected bpf_test_run calls targeting LWT_SEG6LOCAL programs.

What your security team should do

• Prioritize kernel upgrades on all hosts that enable IPv6 segment routing or custom LWT BPF programs
• Audit for any custom BPF programs using the removed test-run path and rewrite them to use supported attachment points
• Monitor vendor advisories for distribution-specific backports of the referenced commit