CVE-2024-26737

What it actually does

Race condition between bpf_timer_cancel and bpf_timer_cancel_and_free allows use-after-free on the internal hrtimer structure after one path frees it while the other still holds a reference.

Why it matters to the business

Attackers with the ability to load and run BPF programs can trigger kernel memory corruption, leading to crashes, denial of service, or potential privilege escalation on Linux systems.

How an attack unfolds

An attacker loads a BPF program that schedules a timer, then concurrently invokes cancel paths from different contexts so that one frees the timer object while the other still calls into the freed hrtimer, causing a use-after-free that can be leveraged for further kernel exploitation.

How to fix it

Update the Linux kernel to a version containing commit 5268bb02107b9eedfdcd51db75b407d10043368c or later; rebuild and reboot with the patched kernel. Disable unprivileged BPF loading via sysctl where feasible until patches are applied.

How to confirm the fix worked

Verify the running kernel contains commit 5268bb02107b9eedfdcd51db75b407d10043368c via git log or kernel version string; attempt to load a test BPF program exercising timer cancel paths under concurrency and confirm absence of UAF reports in dmesg or kmemleak.

Typical attack path

1. Obtain capability to load unprivileged or privileged BPF programs on the target system
2. Create and attach a BPF program that uses bpf_timer helpers
3. Trigger concurrent execution of bpf_timer_cancel and bpf_timer_cancel_and_free from multiple program contexts or threads
4. Trigger the window where one path frees the timer while the other dereferences it
5. Use the resulting UAF to corrupt kernel memory or redirect execution

How to detect it

Review kernel logs (dmesg, /var/log/kern.log) for hrtimer, bpf_timer, or use-after-free related warnings or oops around the time of suspected activity; inspect audit logs for unusual BPF program loads or attach events.

What your security team should do

• Prioritize patching all production Linux kernels to the fixed commit within the next maintenance window
• Restrict unprivileged BPF program loading via kernel.unprivileged_bpf_disabled=1 until systems are updated
• Monitor kernel logs for timer-related warnings or crashes on systems that cannot be immediately patched
• Audit any custom BPF programs that use bpf_timer_cancel helpers for safe usage patterns