CVE-2024-50304

What it actually does

The flaw triggers a false-positive suspicious RCU usage warning in ip_tunnel_find() because hlist_for_each_entry_rcu() lacks a lockdep expression confirming the RTNL mutex is held, even though the per-netns IP tunnel hash table is only accessed from the control path where the mutex is acquired.

Why it matters to the business

Organizations running affected Ubuntu Linux kernel packages may see repeated kernel warnings during IP tunnel configuration, increasing log noise and complicating troubleshooting with no functional disruption or security exposure; the large number of long-supported LTS releases affected increases the operational burden of coordinated kernel upgrades across fleets.

How an attack unfolds

No attacker can exploit this condition because it is solely a debug assertion that fires under correct locking; the RTNL mutex already serializes access, so no race or unauthorized memory access is possible.

How to fix it

Upgrade each affected package to the listed fixed version: linux 3.13.0-161.211 (14.04), 4.4.0-2.16 (16.04), 4.13.0-16.19 (18.04); linux-aws 4.4.0-1002.2 (14.04), 4.4.0-1001.10 (16.04), 4.15.0-1001.1 (18.04); linux-azure 4.15.0-1023.24~14.04.1 (14.04), 4.11.0-1009.9 (16.04), 4.15.0-1002.2 (18.04); and similarly for linux-lts-xenial, linux-euclid, linux-gcp, linux-hwe, linux-kvm, linux-oem, linux-raspi2, and linux-snapdragon using the exact fixed versions provided for each release.

How to confirm the fix worked

After installing the fixed kernel, reboot, confirm the running kernel version matches the fixed package, and verify the absence of the RCU-list traversed warning referencing net/ipv4/ip_tunnel.c:221 when creating or modifying IP tunnels.

Typical attack path

1. No attack path exists

How to detect it

Search kernel logs (dmesg, /var/log/kern.log, journalctl) for the exact warning text mentioning ip_tunnel_find and RCU-list traversed in a non-reader section while the rtnl_mutex is held.

• WARNING: suspicious RCU usage
• RCU-list traversed in non-reader section!!
• net/ipv4/ip_tunnel.c:221
• ip_tunnel_find+0x435/0x4d0

What your security team should do

• Immediately schedule kernel upgrades on all affected Ubuntu 14.04/16.04/18.04 systems using the exact fixed versions listed
• Add the RCU warning string to kernel log monitoring rules for the duration of the rollout
• After patching, remove any temporary suppression of lockdep or RCU warnings that may have been applied