CVE-2024-35886 is a vulnerability identified in the Linux kernel's IPv6 networking stack, specifically within the fib6_dump_done() function. The issue arises from an infinite recursion bug triggered during the destruction of netlink sockets when handling IPv6 routing table dumps. The vulnerability was discovered through fuzz testing with syzkaller, which sent an AF_UNSPEC RTM_GETROUTE message causing the kernel to generate a response. During this process, a failure induced by fault injection at kzalloc() in inet6_dump_fib() led to an inconsistent state where the destructor callback (nlk_sk(sk)->cb.done) was set incorrectly. This caused fib6_dump_done() to recursively call itself indefinitely, eventually hitting the kernel stack guard page and causing a kernel crash (stack overflow). The root cause is that fib6_dump_done() calls fib6_dump_end(), which resets the destructor callback to the same function pointer rather than NULL, resulting in recursive invocation. The fix involves setting the destructor callback only after the successful allocation by kzalloc(), preventing the recursive calls. This vulnerability affects Linux kernel versions around 6.8.0-12821 and likely other versions with similar code. The exploit requires interaction with netlink sockets and the ability to send specific RTM_GETROUTE messages, which are typically accessible to privileged users or processes. No known exploits are currently reported in the wild. The vulnerability impacts kernel stability and availability by causing kernel panics or crashes when triggered.

For European organizations, the primary impact of CVE-2024-35886 is on system availability and reliability. Linux is widely deployed across European enterprises, government agencies, cloud providers, and telecommunications infrastructure. A successful exploitation could lead to denial-of-service (DoS) conditions by crashing affected Linux hosts, disrupting critical services such as web servers, network infrastructure, and cloud workloads. Organizations relying on IPv6 networking and netlink socket communications are particularly at risk. While the vulnerability does not directly expose confidentiality or integrity risks, the resulting system crashes could interrupt business operations, cause data loss due to abrupt shutdowns, and increase operational costs for incident response and recovery. Additionally, systems running containerized workloads or virtualized environments on Linux kernels vulnerable to this issue could experience instability, affecting cloud service availability. Given the increasing adoption of IPv6 in Europe, the scope of affected systems is significant. However, exploitation requires local or network-level access to send crafted netlink messages, limiting remote exploitation without prior access.

European organizations should prioritize patching affected Linux kernel versions as soon as updates become available from their Linux distribution vendors. Since the vulnerability is triggered by netlink socket operations related to IPv6 routing, organizations can implement the following specific mitigations: 1) Restrict access to netlink sockets by limiting permissions to trusted users and processes only, reducing the risk of unauthorized triggering of the vulnerability. 2) Employ network segmentation and firewall rules to limit exposure of systems to untrusted networks, especially restricting IPv6 routing-related traffic. 3) Monitor kernel logs and system behavior for signs of netlink socket errors or kernel panics indicative of attempted exploitation. 4) For high-security environments, consider disabling IPv6 routing features temporarily if feasible until patches are applied. 5) Use kernel hardening features such as stack protector and address space layout randomization (ASLR) to reduce the impact of potential kernel crashes. 6) In containerized or virtualized environments, ensure host kernels are patched promptly and isolate workloads to minimize blast radius. 7) Maintain robust backup and recovery procedures to mitigate operational impact from unexpected system crashes.