Critical Vulnerability Resolved in Linux Kernel's IPv6 Routing

What changed

The Linux kernel has patched a critical vulnerability related to a use-after-free condition in the `ip6_route_mpath_notify()` function. This issue was initially identified by syzbot and has been resolved to prevent potential exploitation.

The fix involves deferring the `fib6_info_release()` calls until after the `ip6_route_mpath_notify()` function has completed its execution, addressing the root cause of the vulnerability.

Who is affected

This vulnerability primarily impacts users and systems running the Linux kernel, particularly those utilizing IPv6 routing functionalities. The following groups and products are notably affected:

Organizations relying on the Linux kernel for their server infrastructure, developers using Linux-based systems, and end-users running affected distributions.

• Linux distributions that include the vulnerable kernel versions.
• Organizations utilizing Linux in cloud environments.
• Developers and system administrators managing network services on Linux.

What to do

It is crucial for affected users to update their Linux kernel to the latest version to mitigate the risk associated with this vulnerability. Regular updates and security patches should be part of an organization's best practices.

Additionally, monitoring security advisories and maintaining awareness of potential vulnerabilities can help in proactive risk management.

• Update to the latest kernel version as soon as possible.
• Review security policies and ensure regular patch management.
• Monitor for any new advisories related to Linux kernel vulnerabilities.