CVE-2024-35895

What it actually does

The vulnerability allows a BPF tracing program invoked from interrupt context with interrupts disabled to perform map_delete_elem on sockmap/sockhash, triggering lock inversion between hardirq-unsafe bucket locks and other host locks, resulting in deadlock.

Why it matters to the business

Linux systems using BPF tracing programs that interact with sockmaps risk kernel deadlocks and system instability; high prevalence of the kernel across servers, containers, and Android devices amplifies potential operational disruption, though low EPSS and no KEV listing limit immediate widespread risk.

How an attack unfolds

An attacker compiles a BPF tracing program that deletes elements from a sockmap/sockhash map, loads it, and triggers execution from a context where interrupts are disabled; this inverts locks as shown in the lockdep report, potentially deadlocking the kernel. No named threat actors are confirmed exploiting this specific issue.

How to fix it

Upgrade the Linux kernel to the commit f7990498b05ac41f7d6a190dc0418ef1d21bf058 or later stable releases that include the check rejecting map_delete_elem from non-hardirq-safe contexts. Map updates remain unaffected.

How to confirm the fix worked

Verify the running kernel contains commit f7990498b05ac41f7d6a190dc0418ef1d21bf058; attempt to load a test BPF tracing program performing sockmap deletion from an interrupts-disabled context and confirm it now returns an error instead of proceeding.

Typical attack path

1. Compile and load a BPF tracing program that calls map_delete_elem on a sockmap or sockhash
2. Trigger the program from an interrupt-disabled context (e.g., certain tracing hooks)
3. Cause lock acquisition order reversal between bucket locks and host locks
4. Induce kernel deadlock observable via lockdep or system hang

How to detect it

Search kernel logs and audit trails for sockmap delete operations originating from BPF tracing programs; look for lockdep warnings mentioning htab buckets and host locks or unexpected map_delete_elem failures after patching.

What your security team should do

• Apply the kernel fix immediately on all affected systems, prioritizing production and high-availability hosts
• Audit existing BPF tracing programs for sockmap/sockhash delete operations and ensure they run only in allowed contexts
• Monitor for future BPF sockmap changes in upstream kernels
• Test patched kernels in staging environments before broad rollout