CVE-2024-35910

What it actually does

Race condition allowing TCP transmit timers on kernel sockets to fire after the owning network namespace has been dismantled, because kernel sockets lack netns references and inet_csk_clear_xmit_timers uses non-synchronous del_timer.

Why it matters to the business

Kernel crashes, panics, or undefined behavior in containerized or modular environments that tear down network namespaces while kernel sockets (RDS, SMC, MPTCP, etc.) remain active; low immediate risk given low EPSS and no KEV listing, but still requires kernel updates across fleets.

How an attack unfolds

An attacker with local access triggers repeated creation and teardown of network namespaces containing kernel sockets; by racing socket close against namespace exit, a timer callback executes after the netns is freed, producing use-after-free conditions that may be chained into privilege escalation or denial of service.

How to fix it

Update the Linux kernel to a version containing commit 93f0133b9d589cc6e865f254ad9be3e9d8133f50 or later; rebuild and deploy the patched kernel, then reboot affected systems. Modules using kernel sockets should call inet_csk_clear_xmit_timers_sync in their netns exit handlers.

How to confirm the fix worked

Confirm the running kernel contains commit 93f0133b9d589cc6e865f254ad9be3e9d8133f50; run existing syzbot reproducers or stress tests that exercise kernel-socket netns teardown; verify absence of timer-related warnings in dmesg after namespace destruction.

Typical attack path

1. Create kernel socket inside a new network namespace
2. Trigger concurrent namespace teardown and socket close operations
3. Allow sk_stop_timer to return while the timer remains armed
4. Netns memory freed before timer callback executes
5. Timer fires on freed memory, causing crash or exploitable corruption

How to detect it

Inspect kernel logs for oops, warnings, or stack traces referencing tcp timers, inet_csk_clear_xmit_timers, or netns teardown; correlate with processes or modules that create kernel sockets inside network namespaces.

What your security team should do

• Prioritize kernel updates on systems using container runtimes or kernel modules with network namespaces
• Add the fixed commit to internal kernel build pipelines and CI regression tests
• Monitor vendor advisories for backported patches in distribution kernels
• Review any local code that opens kernel sockets inside netns exit paths for the new sync helper