CVE-2024-26898

What it actually does

Use-after-free on struct net_device in the AoE driver caused by premature dev_put(ifp) in aoecmd_cfg_pkts while the device pointer remains reachable via the skbtxq global queue during later tx path execution in dev_queue_xmit.

Why it matters to the business

Local attackers on affected Linux systems can trigger kernel crashes, denial of service, or potential arbitrary code execution when AoE networking is in use, leading to system instability and possible full host compromise.

How an attack unfolds

An attacker with local access configures AoE and races aoecmd_cfg_pkts completion against kthread tx processing so that the net_device is freed before dev_queue_xmit accesses it, resulting in a use-after-free that can be turned into memory corruption.

How to fix it

Update the Linux kernel to the fixed commit ad80c34944d7175fa1f5c7a55066020002921a99 or later stable releases that contain the corrected refcount handling in aoecmd_cfg_pkts and tx paths.

How to confirm the fix worked

Verify the running kernel contains commit ad80c34944d7175fa1f5c7a55066020002921a99, inspect aoecmd.c for removal of the early dev_put on success and addition of dev_put after xmit, and confirm AoE functionality remains operational post-upgrade.

Typical attack path

1. Obtain local code execution on a Linux host with AoE enabled
2. Trigger AoE configuration packet handling via aoecmd_cfg_pkts
3. Race the early dev_put against kthread tx path access through skbtxq
4. Perform memory manipulation to achieve denial of service or code execution

How to detect it

Review kernel logs for AoE-related oops or use-after-free warnings, inspect process activity involving AoE configuration, and correlate with unexpected net_device reference count anomalies in crash dumps.

What your security team should do

• Apply the kernel patch containing ad80c34944d7175fa1f5c7a55066020002921a99 immediately on all systems using AoE
• Disable AoE interfaces if the workload does not require them until patches are deployed
• Monitor for local privilege-escalation attempts on kernel hosts