CVE-2024-35839 is a vulnerability identified in the Linux kernel's netfilter bridge component. The issue arises from improper handling of socket buffers (skb) in the ARP queue associated with neighbor entries (neigh->arp_queue). Specifically, when a packet is bridged between virtual Ethernet interfaces (veth), the skb's device pointer (skb->dev) can differ from the neighbor's device (neigh->dev). The vulnerability occurs because skb->dev can be reset to nf_bridge->physindev, a physical device pointer that may have been freed or become invalid without proper synchronization or cleanup. This happens due to the lack of explicit mechanisms preventing physindev from being freed while still referenced in the ARP queue. Consequently, when the kernel processes the ARP queue and attempts to access skb->dev, it may dereference a freed or invalid device pointer, leading to a kernel crash (denial of service). The patch replaces the use of physindev with physinif, relying on the interface index and using dev_get_by_index_rcu() to safely retrieve the original net_device structure or drop the skb if the device is unavailable. This change prevents use-after-free conditions and stabilizes the ARP queue processing in bridged network environments. The vulnerability affects Linux kernel versions identified by the commit hash c4e70a87d975d1f561a00abfe2d3cefa2a486c95 and is currently published without a CVSS score or known exploits in the wild.

For European organizations, this vulnerability poses a risk primarily to systems running Linux kernels with bridging enabled, especially those utilizing virtualized networking environments such as containers, virtual machines, or complex network topologies involving veth pairs. The impact is mainly a denial-of-service condition caused by kernel crashes, which can disrupt critical network services, leading to downtime and potential loss of availability. Organizations relying on Linux-based network appliances, cloud infrastructure, or edge devices with bridging capabilities could experience service interruptions. While the vulnerability does not directly lead to privilege escalation or data leakage, the resulting instability can affect business continuity, especially in sectors like telecommunications, finance, and critical infrastructure where Linux bridging is common. Additionally, the lack of known exploits suggests that the threat is currently theoretical, but the ease of triggering a kernel crash in bridged environments means attackers with network access could exploit it to cause disruption.

European organizations should prioritize updating their Linux kernels to versions that include the patch replacing physindev with physinif and implementing safe device retrieval via dev_get_by_index_rcu(). Specifically, system administrators should: 1) Identify all Linux systems using bridging features, especially those with virtualized network interfaces (veth). 2) Apply the latest kernel updates from trusted Linux distributions that address CVE-2024-35839. 3) For environments where immediate patching is not feasible, consider temporarily disabling bridging or limiting bridged traffic to trusted networks to reduce exposure. 4) Monitor kernel logs for signs of crashes or ARP queue processing errors that may indicate attempted exploitation. 5) Implement network segmentation and strict access controls to minimize the risk of untrusted users triggering the vulnerability. 6) Engage with Linux distribution security advisories to track patch availability and deployment status. These steps go beyond generic advice by focusing on bridging-specific configurations and kernel update management tailored to this vulnerability.