CVE-2024-35884 is a high-severity vulnerability in the Linux kernel related to the handling of UDP Generic Segmentation Offload (GSO) packets when rx-udp-gro-forwarding is enabled. The vulnerability arises because UDP packets may be GROed (Generic Receive Offload) during forwarding, and if these packets land in a tunnel interface, improper handling occurs. Specifically, the kernel function udp_gro_receive attempts to verify that GROed packets correspond to a matching socket within the current network namespace (netns). However, this check is limited to the current netns and does not account for tunneled packets whose endpoints reside in different netns. As a result, such packets can be GROed prematurely at the UDP level, leading to inconsistencies and errors downstream in the packet processing pipeline. The issue was observed with Geneve tunnel packets, where the GSO size is set incorrectly after the Geneve header is pulled. The frag_list skbs (socket buffers) are not properly adjusted for the Geneve header removal, causing skb_segment to misinterpret packet boundaries. This can trigger kernel BUGs, such as the BUG_ON in skb_segment, which arises because the function expects a certain header size that no longer matches the actual packet data. The vulnerability can manifest in various ways, including packet corruption, kernel crashes, or denial of service due to kernel panics. The root cause is the fragile socket lookup in udp_gro_receive, which only checks the current netns and cannot reliably find matching sockets for tunneled packets crossing netns boundaries. The fix involves extending the checks in udp_unexpected_gso to ensure that GSO packets lacking the SKB_GSO_UDP_TUNNEL or SKB_GSO_UDP_CSUM bits and landing in a tunnel are segmented properly before further processing. This prevents premature GROing of tunneled packets and avoids the subsequent packet processing errors. This vulnerability affects Linux kernel versions containing the specified commit hashes and is particularly relevant for systems using UDP GRO forwarding and tunneling protocols such as Geneve. The CVSS 3.1 score is 8.8 (high), reflecting the network attack vector, low attack complexity, required privileges, and the potential for high impact on confidentiality, integrity, and availability.

For European organizations, this vulnerability poses a significant risk especially for those relying on Linux-based infrastructure with advanced networking features such as UDP GRO forwarding and tunneling protocols (e.g., Geneve, VXLAN). Data centers, cloud providers, telecom operators, and enterprises using Linux servers for network virtualization or container orchestration could experience kernel crashes or packet corruption, leading to service disruptions or denial of service. The vulnerability could be exploited by an attacker with local privileges to cause kernel panics, potentially escalating to broader system compromise or impacting availability of critical network services. Given the widespread use of Linux in European IT environments, the impact could affect a broad range of sectors including finance, healthcare, government, and telecommunications. Additionally, the instability caused by this vulnerability could undermine trust in network virtualization technologies and complicate incident response and forensic analysis.

European organizations should prioritize patching affected Linux kernel versions as soon as vendor updates become available. Beyond applying patches, administrators should audit their network configurations to identify if UDP GRO forwarding and tunneling protocols like Geneve are enabled and assess whether these features are necessary. If feasible, temporarily disabling rx-udp-gro-forwarding or tunneling features until patches are applied can reduce exposure. Network namespaces and tunneling configurations should be reviewed to minimize cross-netns packet forwarding that triggers this vulnerability. Monitoring kernel logs for BUG_ON or skb_segment errors can help detect exploitation attempts or crashes. For environments using container orchestration or virtualized networks, ensuring that host kernels are updated and that container runtimes do not expose unnecessary privileges is critical. Finally, implementing strict access controls to limit local user privileges can reduce the risk of exploitation since the vulnerability requires at least local privileges.