CVE-2024-49978

What it actually does

The flaw allows UDP GSO fraglist skbs with corrupted geometry (head_skb size altered by datapath hooks such as NAT or BPF pulling data into linear area) to reach __udpv4_gso_segment_list_csum, resulting in a NULL pointer dereference at udp_hdr(seg->next)->dest and a kernel crash.

Why it matters to the business

Systems processing UDP traffic with segmentation offload enabled may experience kernel panics and service disruption; the issue affects many Linux distributions and downstream products but carries low exploitation probability and no known active campaigns.

How an attack unfolds

An attacker sends crafted UDP packets that trigger GSO fraglist segmentation; optional hooks modify the skb geometry; the kernel then dereferences a NULL pointer during checksum calculation, causing a denial of service. No named threat actors are known to exploit this specific issue.

How to fix it

Upgrade the kernel package to a fixed version such as 4.18.0-305.7.1.el8_4 on Rocky Linux 8 or apply commit 080e6c9a3908de193a48f646c5ce1bfb15676ffc in the stable tree; disable UDP GSO offload as a temporary mitigation if patching is delayed.

How to confirm the fix worked

Confirm the running kernel contains the geometry check before skb_segment_list and verify that the fixed commit or package version is installed; test with UDP traffic that exercises BPF or NAT hooks to ensure no crash occurs.

Typical attack path

1. Send UDP datagrams that rely on GSO fraglist segmentation
2. Invoke NAT, BPF, or similar hooks that pull data into skb linear area
3. Trigger segmentation path that assumes valid fraglist geometry
4. Cause NULL pointer dereference in UDP GSO checksum routine

How to detect it

Inspect kernel logs for NULL pointer dereference oops in __udpv4_gso_segment_list_csum or related GSO functions; look for UDP packets processed through NAT or BPF immediately before crashes; no specific post-exploitation artifacts are known.

What your security team should do

• Prioritize kernel updates on systems handling UDP traffic with segmentation offload
• Monitor for kernel oops or panic logs related to UDP GSO segmentation
• Apply the fix in 4.18.0-305.7.1.el8_4 or the referenced stable commit
• Review BPF programs and NAT rules that may alter skb geometry