CVE-2024-56786

What it actually does

Deferred deallocation of BPF links combined with mismatched RCU grace period semantics between BPF programs and attach hooks could allow a use-after-free when bpf_prog_put is called too early, freeing a program while an attach hook still holds a reference.

Why it matters to the business

Unpatched systems risk kernel crashes, memory corruption, or local privilege escalation that can disrupt services, enable ransomware deployment, or allow attackers to persist in Linux environments; the high number of downstream dependents increases exposure across the ecosystem.

How an attack unfolds

An attacker loads a malicious BPF program attached via a link that uses sleepable hooks, triggers conditions where RCU Tasks Trace and classic RCU GPs race, then uses the freed program pointer to corrupt kernel memory or execute arbitrary code; related threat actor activity around CVE-2025-21702 demonstrates active interest in similar Linux kernel privilege-escalation paths.

How to fix it

Upgrade the Linux kernel to version 6.12.5-1 or later on all Debian 13 systems; apply the fix that moves bpf_prog_put into the bpf_link_dealloc helper and ensure all BPF link types respect the combined RCU Tasks Trace plus classic RCU grace periods before deallocation.

How to confirm the fix worked

Confirm the running kernel reports version 6.12.5-1 or newer, verify the bpf_link_dealloc helper is present in the kernel source or binary, and test that BPF link teardown no longer frees programs before the required grace periods complete.

Typical attack path

1. Obtain local code execution on a vulnerable Linux host
2. Load a BPF program attached through a link that exercises deferred deallocation
3. Trigger RCU grace period timing differences between program and link release
4. Reuse the dangling program pointer for memory corruption or code execution
5. Escalate privileges or install persistence

How to detect it

Search kernel logs and audit trails for unexpected BPF program release errors, RCU stall warnings, or use-after-free reports around bpf_link and bpf_prog_put; inspect system call traces involving BPF link detachment for anomalous timing or crashes that predate the 6.12.5-1 kernel.

What your security team should do

• Immediately schedule kernel upgrades to 6.12.5-1 across all Debian 13 fleets
• Prioritize systems running BPF programs or containers that attach links
• Monitor for post-upgrade stability of sleepable BPF hooks
• Review and restrict untrusted BPF loading until patches are applied