VYPR
← All advisories
Medium severity5.5NVD Advisory· Published Dec 27, 2024· Updated May 17, 2026

CVE-2024-56647

CVE-2024-56647

Description

In the Linux kernel, the following vulnerability has been resolved:

net: Fix icmp host relookup triggering ip_rt_bug

arp link failure may trigger ip_rt_bug while xfrm enabled, call trace is:

WARNING: CPU: 0 PID: 0 at net/ipv4/route.c:1241 ip_rt_bug+0x14/0x20 Modules linked in: CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.12.0-rc6-00077-g2e1b3cc9d7f7 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 RIP: 0010:ip_rt_bug+0x14/0x20 Call Trace:

ip_send_skb+0x14/0x40 __icmp_send+0x42d/0x6a0 ipv4_link_failure+0xe2/0x1d0 arp_error_report+0x3c/0x50 neigh_invalidate+0x8d/0x100 neigh_timer_handler+0x2e1/0x330 call_timer_fn+0x21/0x120 __run_timer_base.part.0+0x1c9/0x270 run_timer_softirq+0x4c/0x80 handle_softirqs+0xac/0x280 irq_exit_rcu+0x62/0x80 sysvec_apic_timer_interrupt+0x77/0x90

The script below reproduces this scenario: ip xfrm policy add src 0.0.0.0/0 dst 0.0.0.0/0 \ dir out priority 0 ptype main flag localok icmp ip l a veth1 type veth ip a a 192.168.141.111/24 dev veth0 ip l s veth0 up ping 192.168.141.155 -c 1

icmp_route_lookup() create input routes for locally generated packets while xfrm relookup ICMP traffic.Then it will set input route (dst->out = ip_rt_bug) to skb for DESTUNREACH.

For ICMP err triggered by locally generated packets, dst->dev of output route is loopback. Generally, xfrm relookup verification is not required on loopback interfaces (net.ipv4.conf.lo.disable_xfrm = 1).

Skip icmp relookup for locally generated packets to fix it.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

In the Linux kernel, ARP link failure with xfrm enabled triggers ip_rt_bug due to incorrect ICMP relookup, causing a kernel warning.

Vulnerability

Description

CVE-2024-56647 is a kernel bug in the IPv4 routing subsystem where an ARP link failure, combined with enabled xfrm (IPsec) policies, causes a WARN_ON in ip_rt_bug. The root cause is in icmp_route_lookup(): when xfrm relookup is performed for locally generated ICMP error messages (e.g., Destination Unreachable), the function incorrectly sets dst->out = ip_rt_bug on the socket buffer. This happens because the relookup creates an input route for a locally generated packet, leading to an invalid routing state [1][2][3].

Exploitation

Conditions

The bug is triggered by a simple sequence: configure an xfrm policy with icmp flag, create a veth pair, assign an IP, and send a ping to an unreachable host on that subnet. The locally generated ICMP Unreachable message then undergoes xfrm relookup, which produces the invalid route. No special privileges are needed beyond the ability to create network interfaces and send packets; the attack surface is local network access.

Impact

When the bug is triggered, the kernel emits a warning message and a stack trace, but does not crash the system. However, repeated triggering could fill kernel logs and cause a minor denial of service. The CVSS v3 score of 5.5 (Medium) reflects the limited impact on availability. There is no evidence of privilege escalation or data leakage.

Mitigation

Patches have been committed to the Linux stable kernel trees (references [1], [2], [3]). The fix skips the ICMP relookup for locally generated packets, as loopback interfaces (which handle local traffic) typically disable xfrm. Users should update to a kernel version containing these commits, or apply the workaround of not using xfrm policies with localok icmp on non-loopback interfaces.

References
  1. Making sure you're not a bot!
  2. Making sure you're not a bot!
  3. Making sure you're not a bot!

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

73

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

3

News mentions

0

No linked articles in our index yet.