CVE-2024-57900 is a high-severity vulnerability identified in the Linux kernel, specifically related to the In-situ Locator Address (ILA) subsystem within the IPv6 networking stack. The root cause of this vulnerability is a race condition in the function ila_add_mapping(), which leads to a use-after-free (UAF) condition in the kernel's rhashtable (resizable hash table) implementation. The race occurs due to concurrent execution of ILA_CMD_ADD commands without proper serialization, causing multiple threads to call nf_register_net_hooks() simultaneously. This concurrency issue was partially addressed in a prior commit (031ae72825ce) that attempted to unregister hooks sooner, but the problem persisted. The fix involves adding a mutex to ensure that only one thread can call nf_register_net_hooks() at a time, preventing the race condition. The vulnerability manifests as a slab-use-after-free detected by Kernel Address Sanitizer (KASAN), with memory corruption occurring in rht_key_hashfn and rhashtable lookup functions. This can lead to kernel crashes, memory corruption, and potentially arbitrary code execution within the kernel context. The vulnerability requires local privileges (PR:L) but no user interaction (UI:N), and the attack vector is local (AV:L), meaning an attacker must have some level of access to the system to exploit it. The impact on confidentiality, integrity, and availability is high, as successful exploitation could allow privilege escalation or denial of service. This vulnerability affects Linux kernel versions prior to the patch and is relevant for systems running kernels around version 6.13.0-rc4 and similar. The vulnerability is categorized under CWE-416 (Use After Free). Although no known exploits are currently reported in the wild, the high CVSS score (7.8) and the nature of the bug indicate a significant risk if exploited.

For European organizations, this vulnerability poses a substantial risk, especially for those relying heavily on Linux-based infrastructure, including servers, cloud environments, and network appliances. Given the local attack vector, the threat is most critical in environments where untrusted users or processes have local access, such as multi-tenant cloud platforms, shared hosting providers, and enterprise internal networks. Exploitation could lead to privilege escalation, allowing attackers to gain root-level access, compromise system integrity, and disrupt availability through kernel crashes or denial of service. The impact extends to critical sectors such as finance, healthcare, telecommunications, and government, where Linux systems are prevalent. Additionally, organizations using Linux in edge computing or IoT devices may face increased exposure due to potentially weaker local access controls. The vulnerability could also be leveraged as a stepping stone for lateral movement within networks, increasing the overall risk posture of affected organizations.

1. Immediate application of the official Linux kernel patch that introduces mutex serialization around nf_register_net_hooks() to prevent concurrent calls and eliminate the race condition. 2. For organizations unable to patch immediately, implement strict local access controls and monitoring to limit untrusted user or process access to vulnerable systems. 3. Employ kernel runtime security tools that can detect anomalous behavior indicative of use-after-free exploitation attempts. 4. Regularly update and audit Linux kernel versions across all systems to ensure timely application of security patches. 5. In cloud environments, enforce strict tenant isolation and minimize the attack surface by disabling unnecessary kernel modules related to ILA if not in use. 6. Conduct thorough testing in staging environments before deploying kernel updates to avoid operational disruptions. 7. Monitor security advisories and threat intelligence feeds for any emerging exploit attempts targeting this vulnerability.