CVE-2024-26591

What it actually does

Missing attach_btf validation in bpf_tracing_prog_attach allows a sequence of rawtp and fentry program loads and link creations (with target_fd=0) to leave dst_trampoline and attach_btf NULL, resulting in a kernel NULL pointer dereference on subsequent attach operations.

Why it matters to the business

Local users can crash the kernel, causing denial of service and potential loss of availability on affected Linux systems; the issue is not known to be exploited in the wild and carries low exploit probability.

How an attack unfolds

An attacker loads a rawtp program, loads an fentry program targeting it, then repeatedly creates tracing links for the fentry program using target_fd=0; the kernel path in bpf_tracing_prog_attach dereferences a NULL attach_btf pointer and panics.

How to fix it

Update the Linux kernel to commit a7b98aa10f895e2569403896f2d19b73b6c95653 or later; apply the stable branch patch that returns -EINVAL for the invalid attach sequence.

How to confirm the fix worked

Confirm the kernel contains commit a7b98aa10f895e2569403896f2d19b73b6c95653; attempt the documented load-and-attach sequence and verify it returns -EINVAL instead of crashing.

Typical attack path

1. Load rawtp BPF program
2. Load fentry BPF program with rawtp as target_fd
3. Create tracing link for fentry using target_fd=0
4. Repeat link creation to trigger the NULL dereference in bpf_tracing_prog_attach

How to detect it

Inspect kernel logs for NULL pointer dereference oops with stack trace containing bpf_tracing_prog_attach; correlate with audit logs showing repeated bpf syscalls for program load and link creation.

• bpf_tracing_prog_attach+0x
• BUG: kernel NULL pointer dereference
• asm_exc_page_fault
• __x64_sys_bpf

What your security team should do

• Prioritize kernel updates on all systems that expose unprivileged BPF to local users
• Restrict unprivileged BPF via sysctl kernel.unprivileged_bpf_disabled=1 where feasible
• Monitor for kernel oops involving bpf_tracing_prog_attach