CVE-2024-26872

What it actually does

Use-after-free write in srpt_refresh_port caused by registering an RDMA event handler before the srpt device is fully initialized, allowing a race on error paths to leave a dangling handler.

Why it matters to the business

Local attackers on affected Linux systems could corrupt kernel memory, potentially leading to crashes or privilege escalation on servers using RDMA/SRPT storage targets; the issue is rare and requires specific timing and local access.

How an attack unfolds

An attacker with local access triggers error paths during srpt device setup to race the partially registered event handler, resulting in a write to freed memory in srpt_refresh_port.

How to fix it

Update the Linux kernel to commit bdd895e0190c464f54f84579e7535d80276f0fc5 or later; ensure the event handler registration occurs only after full srpt device setup.

How to confirm the fix worked

Confirm the running kernel contains commit bdd895e0190c464f54f84579e7535d80276f0fc5; recompile with KASAN and exercise srpt initialization/error paths to verify absence of use-after-free reports.

Typical attack path

1. Obtain local shell on target Linux system with RDMA/SRPT enabled
2. Trigger repeated srpt device initialization and error conditions to hit the race window
3. Use the use-after-free write to corrupt kernel structures and escalate privileges or crash the system

How to detect it

Search kernel logs and KASAN reports for use-after-free writes mentioning srpt_refresh_port; review audit logs for unusual local RDMA device initialization attempts around system boot or module load times.

What your security team should do

• Prioritize kernel updates on systems exposing RDMA/SRPT interfaces
• Restrict local access to RDMA-capable hosts until patched
• Monitor kernel logs for KASAN use-after-free warnings related to srpt_refresh_port