CVE-2024-26723
📋 TL;DR
A NULL pointer dereference vulnerability in the Linux kernel's lan966x driver causes system crashes when adding network interfaces under a Link Aggregation Group (LAG). This affects systems using Microchip lan966x Ethernet controllers with bond/LAG configurations, potentially causing denial of service.
💻 Affected Systems
- Linux kernel with lan966x driver
📦 What is this software?
Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →⚠️ Risk & Real-World Impact
Worst Case
Complete system crash/kernel panic leading to denial of service and potential data loss or corruption.
Likely Case
System crash when configuring network bonding/LAG interfaces, requiring reboot to restore functionality.
If Mitigated
No impact if systems don't use lan966x interfaces in bond/LAG configurations or have patched kernels.
🎯 Exploit Status
Exploitation requires local access to configure network interfaces. The crash occurs during legitimate configuration operations, not through malicious payloads.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Patched in kernel commits: 15faa1f67ab4, 2a492f01228b, 48fae67d8374, b9357489c46c, 15faa1f67ab4
Vendor Advisory: https://git.kernel.org/stable/c/15faa1f67ab405d47789d4702f587ec7df7ef03e
Restart Required: Yes
Instructions:
1. Update Linux kernel to version containing the fix commits. 2. Check with your distribution for backported patches. 3. Reboot system after kernel update.
🔧 Temporary Workarounds
Avoid bond/LAG configuration with lan966x
linuxDo not configure lan966x interfaces under bond or LAG interfaces
# Do not run: ip link set dev eth0 master bond0
# Where eth0 is a lan966x interface
🧯 If You Can't Patch
- Avoid configuring lan966x interfaces in bond/LAG groups
- Implement change control procedures for network configuration changes
🔍 How to Verify
Check if Vulnerable:
Check if system has lan966x interfaces: 'lspci | grep -i lan966x' or 'dmesg | grep lan966x'. If present and using bonding, system may be vulnerable.Check Version:
uname -rVerify Fix Applied:
Check kernel version includes fix commits: 'uname -r' and verify with distribution patch notes. Test bond configuration with lan966x interfaces.📡 Detection & Monitoring
Log Indicators:
- Kernel panic logs
- NULL pointer dereference in kernel logs
- System crash during network configuration
Network Indicators:
- Sudden loss of network connectivity on systems with lan966x bonding
SIEM Query:
source="kernel" AND ("NULL pointer" OR "lan966x" OR "kernel panic")🔗 References
- https://git.kernel.org/stable/c/15faa1f67ab405d47789d4702f587ec7df7ef03e
- https://git.kernel.org/stable/c/2a492f01228b7d091dfe38974ef40dccf8f9f2f1
- https://git.kernel.org/stable/c/48fae67d837488c87379f0c9f27df7391718477c
- https://git.kernel.org/stable/c/b9357489c46c7a43999964628db8b47d3a1f8672
- https://git.kernel.org/stable/c/15faa1f67ab405d47789d4702f587ec7df7ef03e
- https://git.kernel.org/stable/c/2a492f01228b7d091dfe38974ef40dccf8f9f2f1
- https://git.kernel.org/stable/c/48fae67d837488c87379f0c9f27df7391718477c
- https://git.kernel.org/stable/c/b9357489c46c7a43999964628db8b47d3a1f8672
