CVE-2024-27396

What it actually does

Use-after-free in Linux kernel GTP module during gtp_dellink when RCU grace period expires mid-traversal of hlist_for_each_entry_rcu, allowing freed key to be dereferenced.

Why it matters to the business

Local attackers can crash kernel or execute arbitrary code on systems using GTP for mobile data tunneling, causing downtime or full system compromise in affected Linux deployments.

How an attack unfolds

Local attacker triggers repeated GTP link deletion while concurrent RCU operations allow grace period to complete, leading to dereference of freed memory for privilege escalation or denial of service.

How to fix it

Upgrade Linux kernel to commit d8a5b80568a9cb66810e75b182018e9edb68e8ff or later that replaces hlist_for_each_entry_rcu with hlist_for_each_entry_safe in gtp_dellink.

How to confirm the fix worked

Confirm patch presence by inspecting net/gtp.c for hlist_for_each_entry_safe usage in gtp_dellink and test kernel builds with GTP enabled.

Typical attack path

1. Gain local user access on target Linux system
2. Create and delete GTP network devices rapidly
3. Race RCU traversal in gtp_dellink to trigger UAF
4. Leverage freed memory for code execution or kernel panic

How to detect it

Review kernel logs and dmesg for oops/panic messages involving gtp or RCU in net/gtp.c; correlate with GTP device creation/deletion events.

What your security team should do

• Apply kernel update containing the referenced commit to all affected systems
• Restrict untrusted local access on GTP-enabled hosts
• Monitor kernel logs for GTP-related crashes until patched