CVE-2024-44974

What it actually does

Use-after-free in MPTCP select_local_address() and select_signal_address() when endpoint reference is dereferenced after RCU unlock, allowing read of freed memory.

Why it matters to the business

Local attackers can crash Linux systems or escalate privileges on kernels using MPTCP, disrupting operations and increasing risk of compromise across server and endpoint fleets with high downstream prevalence.

How an attack unfolds

Attacker with local access triggers MPTCP endpoint selection functions inside an RCU section, retains a reference, then dereferences it post-unlock to trigger UaF; 2024 Zero-Day Exploitation Campaigns by Espionage and Financially Motivated Actors and Linux Kernel vulnerability campaigns may leverage such flaws.

How to fix it

Upgrade org/pub/scm/linux/kernel/git/stable/linux.git to commit ddee5b4b6a1cc03c1e9921cf34382e094c2009f1 or equivalent fixed kernel release; apply vendor backports promptly given the 2024-09-04 publication and ongoing kernel exposure.

How to confirm the fix worked

Confirm running kernel contains commit ddee5b4b6a1cc03c1e9921cf34382e094c2009f1, exercise MPTCP endpoint selection under load, and verify absence of UaF warnings in kernel logs.

Typical attack path

1. Obtain local code execution on target Linux system
2. Trigger MPTCP path management endpoint selection
3. Retain and later dereference RCU-protected endpoint pointer after unlock
4. Exploit resulting UaF for information leak or memory corruption

How to detect it

Review kernel logs for MPTCP-related use-after-free oops or warnings, correlate with process activity invoking path management, and inspect for exploitation patterns reported in Linux Kernel vulnerability campaigns.

What your security team should do

• Prioritize kernel upgrade on all MPTCP-enabled systems before any CISA-style deadlines
• Restrict local access and MPTCP usage where feasible until patched
• Monitor EPSS trend and threat actor activity for escalation
• Harden local privilege boundaries with LSMs and seccomp