CVE-2024-56751

What it actually does

Failure to release originating fib6_info nexthop reference on IPv6 dst when a device is unregistered leaves elevated usage counts, blocking netdevice free and causing kernel hangs during route lookups involving ip6_dst_alloc and vxlan paths.

Why it matters to the business

Network interface removal or reconfiguration in IPv6 environments using VXLAN or similar tunnels can trigger system hangs or require reboots, increasing downtime risk in cloud, container, and virtualized deployments; low exploitability but high operational impact on affected kernels.

How an attack unfolds

An attacker with local network configuration privileges triggers repeated IPv6 route lookups and device removal sequences (e.g., via VXLAN transmit paths and fib6_rule_lookup) to exhaust or hold dst references; the bug was observed in pmtu.sh tests but could be abused in automated network teardown scenarios by espionage or financially motivated actors targeting Linux hosts.

How to fix it

Upgrade Linux kernel to commit 77aa9855a878fb43f547ddfbda3127a1e88ad31a or later stable releases; apply distro patches equivalent to msgpuck 1.0.3-1.1 where backported; prioritize systems running IPv6 with dynamic interface changes.

How to confirm the fix worked

Verify kernel git commit or package version contains 77aa9855a878fb43f547ddfbda3127a1e88ad31a; re-run pmtu.sh cleanup_ipv6_exception in a loop and confirm no unregister_netdevice waits or ref_tracker splats occur.

Typical attack path

1. Obtain local access or container escape to manipulate network namespaces
2. Create VXLAN or IPv6 tunnel interfaces and populate fib6 routes
3. Initiate device unregister or namespace teardown while active UDP/IPv6 traffic flows
4. Trigger repeated ip6_dst_lookup_flow calls that hold nexthop references
5. Observe unregister_netdevice hang with usage count > 0

How to detect it

Search kernel logs for 'unregister_netdevice: waiting for .* to become free' combined with ref_tracker dst_init traces pointing to ip6_pol_route or vxlan_xmit; inspect for persistent fib6_info references during interface removal events.

What your security team should do

• Patch kernels immediately on all IPv6-enabled hosts and containers
• Monitor for pending device removal hangs via dmesg and netdevice ref_tracker
• Limit unprivileged network namespace creation until patched
• Test VXLAN and IPv6 route teardown in staging before production rollout