A critical vulnerability in the Linux kernel allows unauthenticated remote attackers to bypass network rate-limiting protections, potentially facilitating side-channel attacks and unauthorized traffic analysis.

The Linux kernel inetpeer system utilizes a deterministic Red-Black tree for storing peer entries. An unauthenticated remote attacker can exploit this predictability to force specific node evictions, effectively resetting rate-limiting counters and allowing them to infer open UDP ports or bypass security controls.

The ability to bypass ICMP rate limits and infer open ports presents a significant risk to network security, as it lowers the barrier for reconnaissance and subsequent targeted exploitation of internal services. Given the CVSS score of 9.4, this vulnerability is classified as critical because it facilitates remote, unauthenticated access to network-level information that should remain protected. Successful exploitation could lead to increased exposure of internal systems, facilitating further unauthorized access or denial-of-service conditions.

Immediate Action: Update the Linux kernel to one of the patched versions, specifically 6.1.188, 6.6.157, 6.12.110, or 6.18.52, or apply the relevant upstream fix commits to your distribution kernel.

Proactive Monitoring: Monitor network traffic for unusual patterns of ICMP traffic or repeated connection attempts targeting closed UDP ports, which may indicate an attacker is probing the network topology.

Compensating Controls: Ensure that perimeter firewalls are configured to strictly limit ICMP traffic to only what is necessary, and implement network segmentation to reduce the impact of potential port inference attacks.

Public Exploit Available: No

This vulnerability represents a significant flaw in how the Linux kernel manages peer rate limiting, exposing systems to sophisticated side-channel attacks. Administrators should prioritize patching their kernel versions as soon as vendor updates become available. Because this is a low-level network stack issue, there is no effective software-based workaround other than applying the provided kernel patches or upgrading the affected distribution.