Linux Kernel IPv6 Route Handling Infinite Loop Vulnerability

A vulnerability in the Linux kernel's IPv6 routing can lead to a potential infinite loop, causing a CPU stall. This issue occurs in the 'rt6_fill_node' function, where improper handling of the 'fib6_siblings' list can create a soft lockup. The problem arises when writers holding the 'tb6_lock' remove entries from the 'fib6_siblings' list without waiting for RCU readers to finish, leaving the list in a state that the softirq-side walker cannot process, effectively stalling the CPU. The vulnerability affects the Linux kernel stable tree.

Impact

Exploitation of this vulnerability can cause a soft lockup, where the CPU is stalled and unable to perform other tasks, potentially leading to degraded system performance or responsiveness.

Reproduction

The vulnerability can be reproduced by manipulating the IPv6 routing table in a way that causes high churn in next hops, while simultaneously holding the 'tb6_lock'. This can be done by rapidly adding and removing routes, which triggers the soft lockup in the 'rt6_fill_node' function as the routing walker fails to process the 'fib6_siblings' list correctly.

Remediation

Users can apply the patch available in the Linux kernel stable Git repository to address this vulnerability. Instructions for downloading the patched version are available on the repository's release page.