CVE-2024-35887

What it actually does

Race condition in ax25_ds_del_timer allows a use-after-free when ax25_dev_device_down() calls del_timer() concurrently with ax25_ds_timeout() accessing the freed ax25_dev structure.

Why it matters to the business

Linux systems using the AX.25 protocol can experience kernel crashes, denial of service, or potential local privilege escalation, affecting stability of specialized networking or embedded deployments.

How an attack unfolds

An attacker with local access triggers concurrent device detach and timer expiration paths in the AX.25 stack, causing the timeout handler to dereference memory already freed by ax25_dev_put(), leading to arbitrary read/write or crash.

How to fix it

Apply the upstream fix in commit 74204bf9050f7627aead9875fe4e07ba125cb19b or upgrade to a Linux kernel version containing this commit; rebuild and reboot affected systems.

How to confirm the fix worked

Confirm the patch is present by checking kernel source for timer_shutdown_sync() usage in ax25_ds_del_timer; test device attach/detach under load to verify no UAF occurs.

Typical attack path

1. Obtain local access on a Linux system with AX.25 enabled
2. Trigger ax25 device attach and timer scheduling
3. Initiate device detach via ax25_dev_device_down()
4. Race with timer handler execution to hit freed memory
5. Leverage resulting UAF for kernel memory corruption or DoS

How to detect it

Review kernel logs for ax25-related oops, use-after-free warnings, or panics during device detach; inspect for unusual AX.25 timer activity in dmesg or /proc logs.

What your security team should do

• Prioritize kernel updates for any systems exposing AX.25 interfaces
• Disable AX.25 protocol support if not required
• Monitor for kernel oops or panic logs related to ax25
• Apply the fix within standard patch cycles given low EPSS