CVE-2024-56644

Q: What is the severity of CVE-2024-56644?

CVE-2024-56644 has a CVSS score of 5.5 (MEDIUM). This CVE describes a memory leak vulnerability in the Linux kernel's IPv6 networking stack where expired exception destination cache entries are not properly released. This affects Linux systems using IPv6 networking with specific timing conditions involving TCP connections and ICMPv6 MTU changes. The vulnerability leads to resource exhaustion over time.

5.5 MEDIUM

Denial of Service

📋 TL;DR

This CVE describes a memory leak vulnerability in the Linux kernel's IPv6 networking stack where expired exception destination cache entries are not properly released. This affects Linux systems using IPv6 networking with specific timing conditions involving TCP connections and ICMPv6 MTU changes. The vulnerability leads to resource exhaustion over time.

💻 Affected Systems

Products:

Linux Kernel

Versions: Versions between commit 54c1a859efd9f and the fix commits listed in references

Operating Systems: Linux distributions using affected kernel versions

Default Config Vulnerable: ⚠️ Yes

Notes: Requires IPv6 enabled and specific timing conditions: ICMPv6 MTU change packets, TCP connection timeouts, and FIB6 garbage collector timing.

📦 What is this software?

Debian Linux by Debian

View all CVEs affecting Debian Linux →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Sustained exploitation could lead to kernel memory exhaustion, causing system instability, denial of service, or preventing network namespace cleanup.

🟠

Likely Case

Gradual memory leak over time under specific network conditions, potentially causing performance degradation or system instability.

🟢

If Mitigated

Limited impact with proper monitoring and memory limits in place, though still represents a resource leak.

🌐 Internet-Facing: MEDIUM - Requires specific network conditions but affects systems with IPv6 connectivity.

🏢 Internal Only: MEDIUM - Same technical requirements but within internal networks.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ⚠️ Yes

Complexity: HIGH

Exploitation requires precise timing conditions and specific network traffic patterns, making reliable exploitation difficult.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Fixed in kernel commits: 0b8903e6c881f72c6849d4952de742c656eb5ab9, 3301ab7d5aeb0fe270f73a3d4810c9d1b6a9f045, 535add1e9f274502209cb997801208bbe1ae6c6f, 8b591bd522b71c42a82898290e35d32b482047e4, a95808252e8acc0123bacd2dff8b9af10bc145b7

Vendor Advisory: https://git.kernel.org/stable/c/0b8903e6c881f72c6849d4952de742c656eb5ab9

Restart Required: Yes

Instructions:

1. Update to a kernel version containing the fix commits. 2. Check your distribution's security advisories for backported patches. 3. Reboot the system after kernel update.

🔧 Temporary Workarounds

Disable IPv6

linux

Completely disable IPv6 networking to prevent the vulnerability from being triggered.

echo 'net.ipv6.conf.all.disable_ipv6 = 1' >> /etc/sysctl.conf
echo 'net.ipv6.conf.default.disable_ipv6 = 1' >> /etc/sysctl.conf
sysctl -p

Rate limit ICMPv6 packets

linux

Limit ICMPv6 packets that could trigger the MTU change condition.

iptables -A INPUT -p icmpv6 --icmpv6-type packet-too-big -m limit --limit 10/minute -j ACCEPT
iptables -A INPUT -p icmpv6 --icmpv6-type packet-too-big -j DROP

🧯 If You Can't Patch

Monitor system memory usage and kernel logs for signs of memory leaks or 'unregister_netdevice: waiting for lo to become free' messages.
Implement aggressive TCP timeout settings to reduce the window for the specific timing condition.

🔍 How to Verify

Check if Vulnerable:

Check kernel version and compare with affected commit range: uname -r and examine kernel source or distribution security advisories.

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version includes one of the fix commits: grep -q '0b8903e6c881f72c6849d4952de742c656eb5ab9\|3301ab7d5aeb0fe270f73a3d4810c9d1b6a9f045\|535add1e9f274502209cb997801208bbe1ae6c6f\|8b591bd522b71c42a82898290e35d32b482047e4\|a95808252e8acc0123bacd2dff8b9af10bc145b7' /proc/version

📡 Detection & Monitoring

Log Indicators:

Kernel messages containing 'unregister_netdevice: waiting for lo to become free. Usage count = 2'
Increasing memory usage in /proc/meminfo or system monitoring tools

Network Indicators:

Unusual ICMPv6 packet-too-big messages
TCP connection timeouts in network logs

SIEM Query:

source="kernel" AND "unregister_netdevice: waiting for lo to become free"

📊 Metadata

CVE ID: CVE-2024-56644

CVSS v3 Score: 5.5 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Published: December 27, 2024

Last Updated: January 12, 2026

📋 TL;DR

💻 Affected Systems

📦 What is this software?

Debian Linux by Debian

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

⚠️ Risk & Real-World Impact

Worst Case

Likely Case

If Mitigated

🎯 Exploit Status

🛠️ Fix & Mitigation

✅ Official Fix

Instructions:

🔧 Temporary Workarounds

Disable IPv6

Rate limit ICMPv6 packets

🧯 If You Can't Patch

🔍 How to Verify

Check if Vulnerable:

Check Version:

Verify Fix Applied:

📡 Detection & Monitoring

Log Indicators:

Network Indicators:

SIEM Query:

📊 Metadata

🔗 References

📤 Share & Export