Potential security issue in Linux kernel 5.* — system freeze with ip sta* commands

[Zelgi]

Hello,
I would like to report a potential security issue observed in the Linux kernel 5.* series. (5.15.0-312.187.5.3.el9uek.x86_6)

The problem occurs consistently in virtualized environments, specifically on VMware Workstation and vSphere. Shortly after executing any of the following commands:

ip stat
ip stats
ip sta

the system becomes completely unresponsive within approximately 15 seconds. This makes it very difficult to collect diagnostic information during the failure.

Notably:
• The system does not crash or reboot automatically.
• On the virtualization platform, CPU load steadily increases until the system stops responding.
• This behavior has been reproduced across multiple virtual machines running Linux kernel versions 5., including Oracle Linux 8 and 9.
• No such issue is observed with kernel version 6. under the same conditions.

To assist with your investigation, I am attaching several files collected from the affected systems, including:
• Extracted kernel logs (journalctl -k)
• CPU and PCI information (lscpu, lspci)
• Kernel configuration (/boot/config-*)
• OS release information (/etc/os-release)

Please let me know if further debugging details are needed.

config.txt
kernel.log
lscpu.txt
lspci.txt
os-release.txt
journal_cp.txt

[tvierling]

The above commit is a stray that happened to have the string "#40" in it, causing GitHub to link it to this issue; ignore that.

You said this:

This behavior has been reproduced across multiple virtual machines running Linux kernel versions 5., including Oracle Linux 8 and 9.

You're seeing this on other Linux distros? If so, please show what distros and exact kernel versions (uname -r values). We haven't seen this issue in our environments, and other customers haven't reported it.

[Zelgi]

"I probably expressed myself poorly — at the moment, I’ve noticed the issue on Oracle Linux 8 and 9 servers with kernel version 5+ that includes 'uek' in its name."

[tvierling]

Thank you for the report. We have reproduced this internally. We can't provide ETAs for fixes, but rest assured that we are working on it now.