CVE-2024-56703 – A race condition in the Linux kernel's IPv6 rou... (How to Fix)

Q: What is the severity of CVE-2024-56703?

CVE-2024-56703 has a CVSS score of 5.5 (MEDIUM). A race condition in the Linux kernel's IPv6 routing subsystem can cause soft lockups and system panics when routers experience high next-hop churn in dynamic environments. This affects Linux-based routers and servers handling significant IPv6 traffic with frequent routing updates, particularly those using BGP routing protocols.

📋 TL;DR

A race condition in the Linux kernel's IPv6 routing subsystem can cause soft lockups and system panics when routers experience high next-hop churn in dynamic environments. This affects Linux-based routers and servers handling significant IPv6 traffic with frequent routing updates, particularly those using BGP routing protocols.

💻 Affected Systems

Products:

Linux kernel

Versions: Specific affected versions not specified in CVE, but references indicate fixes in stable kernel trees. Likely affects multiple recent kernel versions before fixes.

Operating Systems: Linux distributions using affected kernel versions

Default Config Vulnerable: ⚠️ Yes

Notes: Requires IPv6 routing with multipath support and frequent routing table updates (e.g., BGP churn). Most impactful on routers with high traffic loads.

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete system lockup requiring reboot, causing network outage and service disruption for all traffic passing through affected routers.

🟠

Likely Case

Intermittent soft lockups during periods of high routing table churn, leading to packet loss, increased latency, and potential watchdog-triggered reboots.

🟢

If Mitigated

With proper kernel patching, no impact beyond normal routing performance during high churn scenarios.

🌐 Internet-Facing: HIGH for edge routers and gateways handling BGP updates and IPv6 traffic.

🏢 Internal Only: MEDIUM for internal routers with dynamic routing, LOW for static routing configurations.

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: NO

Unauthenticated Exploit: ✅ No

Complexity: HIGH

The provided test script demonstrates reliable reproduction under specific conditions (high routing churn + traffic load), but exploitation requires control over routing updates and traffic patterns.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Check specific kernel version from stable commits: 11edcd026012ac18acee0f1514db3ed1b160fc6f, 34a949e7a0869dfa31a40416d2a56973fae1807b, 52da02521ede55fb86546c3fffd9377b3261b91f, d0ec61c9f3583b76aebdbb271f5c0d3fcccd48b2, d9ccb18f83ea2bb654289b6ecf014fd267cc988b

Vendor Advisory: https://git.kernel.org/stable/c/11edcd026012ac18acee0f1514db3ed1b160fc6f

Restart Required: Yes

Instructions:

1. Identify current kernel version. 2. Apply appropriate kernel patch from stable tree. 3. Rebuild kernel if using custom kernel. 4. Reboot system with patched kernel.

🔧 Temporary Workarounds

Reduce routing table churn

linux

Configure BGP/routing daemons to reduce frequency of route updates and implement route dampening

# Configure BGP dampening in bird (example)
protocol bgp {
  dampening on;
  dampening half life 15;
  dampening suppress 2000;
  dampening reuse 750;
  dampening max suppress time 60;
}

Disable IPv6 multipath routing

linux

If multipath routing is not required, disable it to avoid the vulnerable code path

sysctl -w net.ipv6.fib_multipath=0

🧯 If You Can't Patch

Implement aggressive BGP route dampening to minimize routing table churn
Monitor systems for soft lockups and implement automated recovery procedures

🔍 How to Verify

Check if Vulnerable:

Check kernel version and if experiencing soft lockups during high IPv6 routing churn with watchdog panics showing fib6_select_path in stack trace

Check Version:

uname -r

Verify Fix Applied:

Apply kernel patch and test with high routing churn + traffic load; monitor for soft lockups

📡 Detection & Monitoring

Log Indicators:

Watchdog timeout messages
Kernel panic with fib6_select_path in stack trace
Soft lockup detected messages

Network Indicators:

Increased packet loss on IPv6 routes
Routing protocol flaps
Unusual latency spikes

SIEM Query:

event_source="kernel" AND (message="soft lockup" OR message="watchdog" OR message="BUG") AND message CONTAINS "fib6_select_path"

📊 Metadata

CVE ID: CVE-2024-56703

CVSS v3 Score: 5.5 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE: CWE-835

Published: December 28, 2024

Last Updated: November 3, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2024-56703, you might also want to check these: