CVE-2024-42108

What it actually does

The vulnerability is a use-after-free in rswitch_tx_free (inlined into rswitch_poll) where dev_kfree_skb_any frees the skb and then skb->len is read to update interface statistics.

Why it matters to the business

Affected Linux systems may experience kernel crashes or memory corruption during routine network processing on rswitch devices, resulting in unplanned downtime and service disruption.

How an attack unfolds

An attacker sends ordinary packets such as ARP requests or ICMP echoes that cause rswitch_poll to invoke the buggy path; the use-after-free is triggered when the freed skb pointer is dereferenced for statistics.

How to fix it

Apply the upstream fix by updating to the kernel commit 4a41bb9f2b402469d425a1c13359d3b3ea4e6403 or later stable trees that reorder the len access before the free.

How to confirm the fix worked

Confirm the fix commit is present in the running kernel source tree and reproduce traffic with KFENCE enabled to verify absence of splats.

Typical attack path

1. Send network packet (ARP/ICMP) to affected interface
2. rswitch_poll calls rswitch_tx_free
3. skb is freed with dev_kfree_skb_any
4. skb->len is read after free to update stats
5. Kernel reports use-after-free via KFENCE or crashes

How to detect it

Inspect kernel logs and dmesg for KFENCE reports or use-after-free warnings mentioning rswitch_poll or rswitch_tx_free during network activity.

What your security team should do

• Prioritize kernel upgrade to a tree containing commit 4a41bb9f2b402469d425a1c13359d3b3ea4e6403
• Enable KFENCE on test systems to validate the fix before broad rollout
• Monitor kernel logs for rswitch-related oops or use-after-free reports