CVE-2024-38612

When the CONFIG_IPV6_SEG6_LWTUNNEL option is not defined and the seg6_hmac_init() function fails, the error handling path in seg6_init() does not call genl_unregister_family(). This causes an incorrect internal kernel state — resources are not properly freed or unregistered. The bug has existed since commit 46738b1317e1, and the subsequent change (5559cea2d5aa) replaced unregister_pernet_subsys() with a call to genl_unregister_family() in this path, but did not fix the original problem of missing this function call under specific conditions.

An attacker or incorrect system state can lead to use-after-free or NULL pointer dereference in kernel space, which may result in privilege escalation, disclosure of sensitive data, or system failure (denial of service).

Patches available from the vendor should be applied in accordance with references — fixes have been published in stable Linux kernel branches and are available at the addresses indicated in the CVE references section.

Linux Kernel — versions indicated in vendor references (patches available in stable branches referenced by git.kernel.org)