CVE-2024-26731

What it actually does

Concurrent invocation of sk_psock_verdict_data_ready() and sk_psock_stop_verdict() in the Linux kernel BPF sockmap code allows psock->saved_data_ready to become NULL, resulting in a kernel NULL pointer dereference when unix_stream_sendmsg triggers the data-ready callback.

Why it matters to the business

Systems running affected Linux kernels that use BPF sockmap features may experience unexpected kernel crashes or denial of service, leading to service interruptions and requiring urgent kernel updates across fleets.

How an attack unfolds

An attacker with local access crafts concurrent operations on unix domain sockets while a BPF sockmap verdict program is active; by racing sk_psock_stop_verdict against sendmsg paths the NULL saved_data_ready pointer is dereferenced, crashing the kernel.

How to fix it

Upgrade the Linux kernel to a fixed version such as 6.1.80 or apply commit 4588b13abcbd561ec67f5b3c1cb2eff690990a54; rebuild and reboot with the patched kernel; disable BPF sockmap features if immediate patching is impossible.

How to confirm the fix worked

Verify the running kernel version is at or above the fixed release or confirm the presence of the sk_psock_data_ready helper and sk->sk_callback_lock protection in net/core/skmsg.c; test concurrent sockmap send and stop paths under load to confirm absence of the NULL dereference.

Typical attack path

1. Obtain local unprivileged access on an affected Linux system
2. Load or attach a BPF sockmap verdict program
3. Perform concurrent unix_stream_sendmsg and sockmap stop operations
4. Trigger the race that dereferences the NULL saved_data_ready pointer

How to detect it

Inspect kernel logs (dmesg, /var/log/kern.log, journalctl) for BUG: kernel NULL pointer dereference entries with a call trace containing sk_psock_verdict_data_ready and unix_stream_sendmsg; correlate with processes using BPF sockmap or unix sockets around the crash time.

• sk_psock_verdict_data_ready+0x232/0x340
• BUG: kernel NULL pointer dereference, address: 0000000000000000
• RIP: 0010:0x0
• net/core/skmsg.c:1230

What your security team should do

• Prioritize kernel upgrades to 6.1.80 or later on all affected hosts
• Apply the referenced commit and rebuild custom kernels where backports are required
• Restrict unprivileged BPF loading until patches are deployed
• Monitor kernel update channels for additional stable backports