CVE-2024-35886

Q: What is the severity of CVE-2024-35886?

CVE-2024-35886 has a CVSS score of 7.8 (HIGH). A stack overflow vulnerability in the Linux kernel's IPv6 routing table dump functionality allows local attackers to trigger infinite recursion during netlink socket destruction, leading to kernel panic and denial of service. This affects systems with IPv6 enabled and requires local access to trigger. The vulnerability was discovered through fault injection testing.

7.8 HIGH

Denial of Service

📋 TL;DR

A stack overflow vulnerability in the Linux kernel's IPv6 routing table dump functionality allows local attackers to trigger infinite recursion during netlink socket destruction, leading to kernel panic and denial of service. This affects systems with IPv6 enabled and requires local access to trigger. The vulnerability was discovered through fault injection testing.

💻 Affected Systems

Products:

Linux kernel

Versions: Versions before the fix commits (specific versions vary by distribution, but generally Linux kernel versions around 6.8.0 and earlier with the vulnerable code)

Operating Systems: Linux distributions using affected kernel versions

Default Config Vulnerable: ⚠️ Yes

Notes: Requires IPv6 support enabled (common in modern distributions) and netlink route socket access. The vulnerability triggers during specific error conditions in fib6 dump operations.

📦 What is this software?

Debian Linux by Debian

View all CVEs affecting Debian Linux →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Kernel panic leading to system crash and denial of service, requiring physical or remote console access to reboot.

🟠

Likely Case

Local denial of service through kernel panic, disrupting services on the affected system.

🟢

If Mitigated

Minimal impact with proper patching; unprivileged users cannot trigger without specific netlink access.

🌐 Internet-Facing: LOW - Requires local access to trigger, not directly exploitable over network.

🏢 Internal Only: MEDIUM - Local users or processes with netlink socket access can cause system crashes.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM - Requires local access and ability to trigger specific netlink operations with fault injection conditions.

Discovered through syzkaller fuzzing; exploitation requires precise timing and error conditions to trigger the infinite recursion.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Fixed in Linux kernel commits: 167d4b47a9bdcb01541dfa29e9f3cbb8edd3dfd2, 40a344b2ddc06c1a2caa7208a43911f39c662778, 4a7c465a5dcd657d59d25bf4815e19ac05c13061, 9472d07cd095cbd3294ac54c42f304a38fbe9bfe, 9c5258196182c25b55c33167cd72fdd9bbf08985

Vendor Advisory: https://git.kernel.org/stable/c/167d4b47a9bdcb01541dfa29e9f3cbb8edd3dfd2

Restart Required: Yes

Instructions:

1. Update Linux kernel to version containing the fix commits. 2. For distributions: Use package manager (apt/yum/dnf) to install latest kernel updates. 3. Reboot system to load new kernel.

🔧 Temporary Workarounds

Disable IPv6

linux

Prevents the vulnerable IPv6 fib6 dump code from being executed.

echo 1 > /proc/sys/net/ipv6/conf/all/disable_ipv6
sysctl -w net.ipv6.conf.all.disable_ipv6=1

Restrict netlink socket access

linux

Limit which users can create netlink route sockets to reduce attack surface.

Use Linux capabilities or SELinux/AppArmor to restrict NET_ADMIN and NET_RAW capabilities

🧯 If You Can't Patch

Implement strict access controls to prevent unprivileged users from creating netlink sockets
Monitor system logs for kernel panic events and implement crash recovery automation

🔍 How to Verify

Check if Vulnerable:

Check kernel version and compare with distribution's patched versions. Vulnerable if running kernel before fix commits.

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version includes the fix commits: 'uname -r' and check distribution security advisories.

📡 Detection & Monitoring

Log Indicators:

Kernel panic messages in /var/log/kern.log or dmesg
Stack guard page hit errors
Recursive fib6_dump_done calls

Network Indicators:

Unusual netlink socket activity from unprivileged users

SIEM Query:

source="kernel" AND ("stack guard page" OR "fib6_dump_done" OR "kernel panic")

📊 Metadata

CVE ID: CVE-2024-35886

CVSS v3 Score: 7.8 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-674

Published: May 19, 2024

Last Updated: December 23, 2025

📋 TL;DR

💻 Affected Systems

📦 What is this software?

Debian Linux by Debian

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

⚠️ Risk & Real-World Impact

Worst Case

Likely Case

If Mitigated

🎯 Exploit Status

🛠️ Fix & Mitigation

✅ Official Fix

Instructions:

🔧 Temporary Workarounds

Disable IPv6

Restrict netlink socket access

🧯 If You Can't Patch

🔍 How to Verify

Check if Vulnerable:

Check Version:

Verify Fix Applied:

📡 Detection & Monitoring

Log Indicators:

Network Indicators:

SIEM Query:

📊 Metadata

🔗 References

📤 Share & Export

🔗 Related Vulnerabilities