CVE-2024-46763 – A NULL pointer dereference vulnerability in the... (How to Fix)

Q: What is the severity of CVE-2024-46763?

CVE-2024-46763 has a CVSS score of 5.5 (MEDIUM). A NULL pointer dereference vulnerability in the Linux kernel's FOU (Foo over UDP) implementation allows denial of service through kernel panic when shutting down network namespaces or tearing down tunnels. This affects Linux systems using FOU tunnels, primarily in containerized or virtualized environments where network namespaces are frequently created/destroyed.

📋 TL;DR

A NULL pointer dereference vulnerability in the Linux kernel's FOU (Foo over UDP) implementation allows denial of service through kernel panic when shutting down network namespaces or tearing down tunnels. This affects Linux systems using FOU tunnels, primarily in containerized or virtualized environments where network namespaces are frequently created/destroyed.

💻 Affected Systems

Products:

Linux kernel

Versions: Kernel versions with FOU support (introduced in 3.18) up to patched versions. Specifically affects versions where the fix commits are not applied.

Operating Systems: Linux distributions using affected kernel versions

Default Config Vulnerable: ✅ No

Notes: Only vulnerable if FOU (Foo over UDP) tunnels are configured and used. Most systems don't use FOU by default.

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Kernel panic leading to system crash and denial of service, potentially disrupting all services on the affected host.

🟠

Likely Case

System crash during network namespace teardown or tunnel shutdown operations, causing temporary service disruption until system reboot.

🟢

If Mitigated

No impact if FOU tunnels are not used or if systems are patched with proper NULL pointer checks.

🌐 Internet-Facing: LOW - Requires specific FOU tunnel configuration and network namespace operations, not typically exposed directly to internet.

🏢 Internal Only: MEDIUM - Affects systems using FOU tunnels in container/virtualization environments where network namespaces are managed.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Exploitation requires ability to trigger FOU tunnel teardown or network namespace dismantle, typically requiring privileged access or specific container orchestration operations.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Fixed in kernel commits: 1df42be305fe478ded1ee0c1d775f4ece713483b, 231c235d2f7a66f018f172e26ffd47c363f244ef, 4494bccb52ffda22ce5a1163a776d970e6229e08, 7e4196935069947d8b70b09c1660b67b067e75cb, c46cd6aaca81040deaea3500ba75126963294bd9

Vendor Advisory: https://git.kernel.org/stable/c/1df42be305fe478ded1ee0c1d775f4ece713483b

Restart Required: Yes

Instructions:

1. Update Linux kernel to version containing the fix commits. 2. Check with your distribution vendor for backported patches. 3. Reboot system after kernel update.

🔧 Temporary Workarounds

Disable FOU tunnels

linux

Prevent use of FOU tunnels which eliminates the vulnerability vector

# Remove FOU module if loaded
sudo rmmod fou
# Blacklist FOU module
echo 'blacklist fou' | sudo tee /etc/modprobe.d/blacklist-fou.conf

🧯 If You Can't Patch

Avoid using FOU tunnels in production environments
Minimize network namespace creation/destruction operations on systems with FOU configured

🔍 How to Verify

Check if Vulnerable:

Check if FOU module is loaded and kernel version is vulnerable: lsmod | grep fou && uname -r

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version includes fix commits or check with distribution vendor for patch status

📡 Detection & Monitoring

Log Indicators:

Kernel panic logs mentioning 'NULL pointer dereference' in fou_gro_receive
System crash/reboot logs during network operations

Network Indicators:

Unexpected system crashes during container/virtual machine network operations

SIEM Query:

event_type:kernel_panic AND message:"fou_gro_receive" OR "NULL pointer dereference" AND module:fou

📊 Metadata

CVE ID: CVE-2024-46763

CVSS v3 Score: 5.5 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE: CWE-476

Published: September 18, 2024

Last Updated: November 3, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2024-46763, you might also want to check these: