CVE-2024-36978

What it actually does

Out-of-bounds kernel memory write in sch_multiq due to using stale q->bands value during kmalloc for new qopt->bands, allowing corruption of adjacent kernel structures.

Why it matters to the business

Local attackers can crash Linux systems or escalate privileges to root, leading to full host compromise, data theft, or ransomware deployment on servers and endpoints running affected kernels; widespread impact given Linux prevalence in infrastructure.

How an attack unfolds

A local attacker with unprivileged access creates or modifies a multiq qdisc via netlink, supplying a bands value that triggers the buggy kmalloc path using the old bands pointer, resulting in controlled out-of-bounds write to achieve privilege escalation or denial of service.

How to fix it

Upgrade the Linux kernel to a version containing commit d5d9d241786f49ae7cbc08e7fc95a115e9d80f3d or later stable releases that resolve the multiq_tune OOB write; rebuild and reboot into the patched kernel.

How to confirm the fix worked

Confirm kernel source contains the referenced commit, verify q->bands is not referenced before the new allocation in sch_multiq.c, and test with reproducer qdisc configurations that previously triggered the bug.

Typical attack path

1. Obtain local shell access on target Linux system
2. Craft malicious netlink message to configure multiq qdisc with specific bands value
3. Trigger allocation path in multiq_tune that reuses stale bands pointer
4. Perform out-of-bounds write to corrupt kernel memory for code execution or crash
5. Escalate to root or stabilize kernel exploit payload

How to detect it

Review kernel logs for oops or panic entries involving sch_multiq or multiq_tune; inspect audit logs for netlink operations creating or tuning qdisc objects with unexpected bands values; correlate with local user activity preceding crashes.

What your security team should do

• Prioritize kernel upgrades on all exposed Linux hosts within 30 days given local exploit potential
• Restrict unprivileged users from netlink qdisc configuration via SELinux/AppArmor or capabilities where possible
• Monitor for unusual qdisc configuration attempts in system logs on critical systems
• Apply live kernel patching if available for high-value assets until reboot is feasible