CVE-2024-26631

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ipv6: mcast: fix data-race in ipv6_mc_down / mld_ifc_work

idev->mc_ifc_count can be written over without proper locking.

Originally found by syzbot [1], fix this issue by encapsulating calls

to mld_ifc_stop_work() (and mld_gq_stop_work() for good measure) with

mutex_lock() and mutex_unlock() accordingly as these functions

should only be called with mc_lock per their declarations.

[1]

BUG: KCSAN: data-race in ipv6_mc_down / mld_ifc_work

write to 0xffff88813a80c832 of 1 bytes by task 3771 on cpu 0:

mld_ifc_stop_work net/ipv6/mcast.c:1080 [inline]

ipv6_mc_down+0x10a/0x280 net/ipv6/mcast.c:2725

addrconf_ifdown+0xe32/0xf10 net/ipv6/addrconf.c:3949

addrconf_notify+0x310/0x980

notifier_call_chain kernel/notifier.c:93 [inline]

raw_notifier_call_chain+0x6b/0x1c0 kernel/notifier.c:461

__dev_notify_flags+0x205/0x3d0

dev_change_flags+0xab/0xd0 net/core/dev.c:8685

do_setlink+0x9f6/0x2430 net/core/rtnetlink.c:2916

rtn

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References