Linux kernel BPF: use-after-free freeing map elements that hold BPF timers

Impact

Freeing a map element containing a BPF timer could free the bpf_hrtimer state, and with it the struct hrtimer, while that timer was still armed and enqueued - the RCU grace period expires before a far-future expiry fires. That is a kernel use-after-free on a timer the attacker controls the arming of, which is the shape of bug that turns BPF access into host root. On a GPU node this matters where BPF is reachable beyond the host admin: eBPF-based CNI and observability agents, and any workload granted CAP_BPF or privileged pods. The fix defers cancellation to the global workqueue rather than cancelling inline, which would deadlock. The record describes the mechanism but no public exploit.

Who can reach it

Local user or container able to load BPF programs and update BPF maps - in practice CAP_BPF/CAP_SYS_ADMIN in the init namespace, or a privileged pod. Not reachable by an unprivileged tenant pod on a node with default BPF restrictions, and not remote.

What to do

Update to a stable kernel carrying the fix (three stable commits linked; fixed in the 6.10 stable series per the record) and reboot each node. Mitigation in the meantime is to stop handing out CAP_BPF and privileged pods on shared GPU nodes and to confirm kernel.unprivileged_bpf_disabled is set; that is an admission-policy change rather than a reboot. Hosts running eBPF CNI or tracing agents still load BPF as root, so the patch is the real fix there.

References

Related entries

• Linux i915 GPU kernel driver: A use-after-free in the i915 GPU kernel driver. The general shape is that a GPU object isCVE-2024-41092 · Linux i915 GPU kernel driverHigh
• Linux kernel (drivers/pci/msi): When MSI vector allocation for a PCI device fails, the core MSI code keeps using aCVE-2024-41096 · Linux kernel (drivers/pci/msi)High
• Linux kernel (drivers/gpu/drm/xe): The Xe VRAM manager computed a buffer object's minimum page size by shifting aCVE-2024-42066 · Linux kernel (drivers/gpu/drm/xe)High
• Linux kernel (drivers/gpu/drm/i915/gem): The size of a partial GEM mapping is computed without accounting for theCVE-2024-42259 · Linux kernel (drivers/gpu/drm/i915/gem)High
• QEMU (qemu-img): `qemu-img info` on an untrusted qcow2 image reaches arbitrary host file read/writeCVE-2024-4467 · QEMU (qemu-img)High
• Linux kernel (drivers/gpu/drm/xe): Freeing a scheduler job dereferences the VM it belongs to, but the final exec-queueCVE-2024-44978 · Linux kernel (drivers/gpu/drm/xe)High