CVE-2024-42075

What it actually does

The BPF arena implementation lacked reference counting for multiple mmap events triggered by mremap, allowing a use-after-free condition when arena_vm_close executes on a remapped arena.

Why it matters to the business

Local users on affected Linux kernels can trigger kernel instability or crashes; systems running unpatched kernels face availability risk until upgraded, with higher urgency on widely deployed servers and containers.

How an attack unfolds

An attacker with local access creates a BPF arena mapping, performs an mremap operation to duplicate references without incrementing the internal count, then triggers arena_vm_close to free the structure while it is still referenced, resulting in a use-after-free.

How to fix it

Upgrade the Linux kernel to a version containing commit a38297e3fb012ddfa7ce0321a7e5a8daeb1872b6 or later; rebuild and reboot with the patched kernel; apply distribution-specific updates that include this fix.

How to confirm the fix worked

Verify the running kernel contains commit a38297e3fb012ddfa7ce0321a7e5a8daeb1872b6 or a backported equivalent; confirm the refcnt logic is present in kernel/bpf/arena.c; test that multiple mmap/mremap operations no longer trigger use-after-free.

Typical attack path

1. Obtain local user access on a vulnerable Linux system
2. Load or attach a BPF program that creates an arena mapping
3. Issue mremap syscall on the arena virtual memory area
4. Trigger arena_vm_close through unmap or process exit
5. Trigger the use-after-free to cause denial of service

How to detect it

Review kernel logs for oops or panic messages referencing arena_vm_close or bpf_arena; inspect audit logs for unusual mremap or BPF program load activity by non-root users; correlate with process termination events.

What your security team should do

• Prioritize kernel upgrades on all production systems within the next maintenance window
• Enable kernel crash reporting and monitor for arena-related oops until patched
• Restrict unprivileged BPF and mremap usage via LSM or seccomp where feasible
• Track distribution advisories for backported fixes