CVE-2024-56703 is a vulnerability in the Linux kernel's IPv6 routing subsystem, specifically within the fib6_select_path function responsible for selecting the next hop path for IPv6 packets. The issue manifests as a soft lockup caused by an infinite loop during traversal of a multipath circular linked list of routing siblings. This occurs under conditions of high next hop churn, such as in environments where BGP routes are frequently updated, for example, Linux-based edge routers running the 'bird' routing daemon. The root cause is concurrent deletion of linked list nodes on a different CPU core without proper synchronization, leading to corrupted list pointers where nodes point to themselves and reference counts drop to zero. This causes the kernel to enter an infinite loop, triggering a soft lockup detected by the watchdog timer and resulting in a system panic and crash. The fix involves applying Read-Copy-Update (RCU) synchronization primitives to safely manage concurrent access and deletion of fib6_siblings nodes, preventing the infinite loop condition. A test script has been developed that reproduces the issue by continuously updating the routing table while generating heavy IPv6 traffic, reliably causing the soft lockup within minutes. The vulnerability affects Linux kernel versions identified by the provided commit hashes (all identical in this report), and no CVSS score has been assigned yet. No known exploits are currently reported in the wild. The kernel log trace included shows the panic occurring at fib6_select_path, confirming the infinite loop during IPv6 route selection under heavy multipath and next hop update conditions.

For European organizations, especially those operating large-scale network infrastructure such as ISPs, cloud providers, data centers, and enterprises with complex IPv6 routing environments, this vulnerability poses a significant risk to network availability and reliability. Edge routers and other network devices running Linux kernels vulnerable to this issue may experience system panics and crashes under high route update loads, leading to network outages or degraded service. This can disrupt critical business operations, impact service level agreements, and cause cascading failures in dependent systems. Given the increasing adoption of IPv6 in Europe and the use of Linux-based routing platforms, the vulnerability could affect a broad range of organizations managing dynamic BGP routing with multipath configurations. While the vulnerability does not appear to allow direct code execution or privilege escalation, the denial-of-service impact on network infrastructure is severe. The lack of known exploits reduces immediate risk, but the reproducibility of the issue and its presence in core kernel networking code make timely patching essential to maintain operational stability.

European organizations should prioritize updating their Linux kernel versions to incorporate the patch that applies RCU synchronization to the fib6_select_path function and related code managing fib6_siblings. Since the vulnerability arises under conditions of high next hop churn and heavy IPv6 traffic, organizations can temporarily mitigate risk by reducing the frequency of BGP route updates where feasible and limiting multipath configurations that cause rapid linked list modifications. Network administrators should monitor kernel logs for signs of soft lockups or watchdog timer panics related to IPv6 routing. Deploying kernel live patching solutions where available can reduce downtime during patch application. Additionally, testing the patch in staging environments that simulate high route churn and IPv6 traffic loads is recommended to ensure stability before production deployment. Network design reviews to minimize unnecessary route flapping and optimize BGP configurations can also reduce exposure. Finally, organizations should maintain robust backup and recovery procedures to quickly restore affected systems in case of crashes.