CVE-2024-36903: 
Linux Kernel vulnerability analysis and mitigation

CVE-2024-36903 is a vulnerability in the Linux kernel's IPv6 implementation that involves potential uninitialized value access in the __ip6_make_skb() function. The vulnerability was discovered and disclosed on May 30, 2024, affecting multiple versions of the Linux kernel (NVD).

The vulnerability stems from a race condition in the IPv6 packet creation process where an uninitialized value could be accessed in the __ip6_make_skb() function. The issue occurs when checking socket header inclusion flags, similar to a previous IPv4 fix. The fix involves checking FLOWI_FLAG_KNOWN_NH on fl6->flowi6_flags instead of testing HDRINCL on the socket to prevent the race condition (Kernel Patch). The vulnerability has been assigned a CVSS v3.1 base score of 5.5 (Medium) with vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (NVD).

The vulnerability can lead to potential system instability or denial of service due to uninitialized value access in the IPv6 packet creation process. The impact is limited to local attacks and primarily affects system availability, with no direct impact on confidentiality or integrity (NVD).

The vulnerability requires local access and low privileges to exploit. It has been classified as having low attack complexity, requiring no user interaction for exploitation (NVD).

The vulnerability has been patched in various Linux kernel versions. Fixed versions are available in distribution updates, including Ubuntu 24.04 LTS (noble) with kernel version 6.8.0-40.40 and Red Hat Enterprise Linux 9 with kernel version 5.14.0-427.31.1 (Ubuntu, Red Hat).