Missing synchronization in the Linux kernel nexthop subsystem exposes a vulnerability that can be leveraged by a local attacker to compromise system integrity.

The functions fib6_check_nh_list and __nexthop_replace_notify fail to acquire the necessary nh->lock during f6i_list walks. An authenticated local attacker can exploit this concurrency issue to interfere with nexthop replacements.

This vulnerability provides a pathway for a local attacker to cause instability or gain unauthorized control over system networking. The CVSS score of 8.8 reflects the high impact on confidentiality, integrity, and availability, making it a critical concern for secure computing environments.

Immediate Action: Update the affected Linux kernel to version 7.1.8 or higher to resolve the locking deficiency.

Proactive Monitoring: Monitor for kernel-level exceptions or unexpected network stack behavior that could indicate an attempt to exploit race conditions.

Compensating Controls: Minimize the availability of administrative or network configuration commands to unprivileged users to reduce the likelihood of triggering the vulnerable code path.

Public Exploit Available: No

Prompt remediation is required to protect against potential privilege escalation and denial of service. System administrators must prioritize kernel updates to 7.1.8 to ensure that mandatory locking is enforced within the nexthop subsystem.