CVE-2024-40961

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.10.0-rc2-syzkaller-00249-gbe27b8965297

Description A vulnerability in the Linux kernel has been resolved, which prevents a possible NULL pointer dereference in the fib6 nh init() function. The issue occurs because in6 dev get() can return NULL, and this return value is not properly checked. This can lead to a general protection fault, likely due to a non-canonical address. The vulnerability is related to the IPv6 routing code and can be triggered through the ipv6 route ioctl() function.

Recommendations To resolve this issue, update the Linux kernel to a version that includes the fix for this vulnerability. Specifically, versions prior to 6.10.0-rc2-syzkaller-00249-gbe27b8965297 are affected. As a temporary workaround, consider disabling the fib6 nh init() function until a patch is available. However, this may have unintended consequences on IPv6 routing functionality.

At the moment, there is no information about a newer version that contains a fix for this vulnerability.