CVE-2024-40909

What it actually does

Use-after-free in bpf_link_free() where link->ops->dealloc_deferred frees the object but subsequent code still dereferences link->ops->dealloc, causing memory corruption in the kernel BPF subsystem.

Why it matters to the business

Kernel memory corruption can crash systems or allow local privilege escalation, disrupting Linux workloads and increasing breach risk in servers, containers, and Android devices that rely on the affected kernels.

How an attack unfolds

An attacker with the ability to manage BPF links triggers the double deallocation path introduced after commit 1a80dbcb2dba; the deferred deallocator frees the structure while the original code path still reads from it, enabling controlled memory reuse for kernel code execution.

How to fix it

Upgrade to a fixed kernel version such as 6.6.35 or apply commit 91cff53136daeff50816b0baeafd38a6976f6209; rebuild and reboot all affected systems; disable unneeded BPF features where upgrades are delayed.

How to confirm the fix worked

Confirm the running kernel contains the fix commit or is at least version 6.6.35; inspect bpf_link_free() source to verify only one deallocation path is taken and the WARN_ON guard is present.

Typical attack path

1. Obtain capability to create and free BPF links (CAP_BPF or unprivileged BPF)
2. Craft a sequence of link operations that hits the dealloc_deferred code path
3. Trigger the use-after-free by racing or ordering deallocation calls
4. Reuse the freed memory to corrupt kernel structures or redirect control flow

How to detect it

Review kernel logs for syzbot-style use-after-free reports or KASAN splats referencing bpf_link_free; examine audit logs for unusual BPF link creation and deletion activity by untrusted users.

What your security team should do

• Prioritize patching production kernels within the next maintenance window
• Restrict unprivileged BPF access via sysctl kernel.unprivileged_bpf_disabled=1 until patched
• Monitor kernel update channels for backports to distribution-specific kernels