Database/Kernel, userspace & hypervisor
Linux kernel BPF: use-after-free in bpf_link_free when a link uses deferred deallocation
Impact
After the switch to link->ops->dealloc_deferred, bpf_link_free still tested and used link->ops->dealloc on an object that had already been freed, which syzbot caught as a use-after-free. Freeing a kernel object twice through differing paths is a classic route from a crash to controlled memory corruption, and BPF links are created and destroyed by anything that attaches a program - observability agents, CNI dataplanes, security sensors. On a GPU fleet that stack runs on every node, so the code path is live even where no tenant is given BPF access directly. The fix is a one-line correction plus a WARN_ON.
Who can reach it
Local, and requires the ability to create and destroy BPF links - CAP_BPF or root, or a container granted it. A plain unprivileged tenant pod cannot reach this.
What to do
Pick up the stable kernel fix through your distribution kernel and reboot each node onto it; the four listed stable commits cover the affected branches. There is no userspace mitigation other than withholding CAP_BPF from workloads, which usually also disables the observability agents you were running. Plan a rolling drain and reboot.
References
Related entries
- Linux kernel mlx5_ib (shared receive queue): The max_sge attribute for a shared receive queue is taken from the userCVE-2024-40990 · Linux kernel mlx5_ib (shared receive queue)High
- Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd): A correctness defect in the amdkfd (KFD computeCVE-2024-41011 · Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd)High
- Linux kernel BPF: use-after-free freeing map elements that hold BPF timersCVE-2024-41045 · Linux kernel BPF timers (bpf_timer_cancel_and_free, hrtimer freed while still enqueued)High
- Linux i915 GPU kernel driver: A use-after-free in the i915 GPU kernel driver. The general shape is that a GPU object isCVE-2024-41092 · Linux i915 GPU kernel driverHigh
- Linux kernel (drivers/pci/msi): When MSI vector allocation for a PCI device fails, the core MSI code keeps using aCVE-2024-41096 · Linux kernel (drivers/pci/msi)High
- Linux kernel (drivers/gpu/drm/xe): The Xe VRAM manager computed a buffer object's minimum page size by shifting aCVE-2024-42066 · Linux kernel (drivers/gpu/drm/xe)High
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.