Riskcovery

CVE-2024-40909

bpf: Fix a potential use-after-free in bpf_link_free()

State
Published
Severity
7.8 High
Published
Jul 12, 2024
Updated
Oct 30, 2026
Reserved
Jul 12, 2024

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix a potential use-after-free in bpf_link_free()

After commit 1a80dbcb2dba, bpf_link can be freed by link->ops->dealloc_deferred, but the code still tests and uses link->ops->dealloc afterward, which leads to a use-after-free as reported by syzbot. Actually, one of them should be sufficient, so just call one of them instead of both. Also add a WARN_ON() in case of any problematic implementation.

Scores

CVSSScoreVectorSource
3.17.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HLinux

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • ac48dc6ac9240f73bf08d29edf65c2deca93ee5d to before e8ccda39b395169622855607085cdeef4d376e0fAffected
  • 876941f533e7b47fc69977fc4551c02f2d18af97 to before 91cff53136daeff50816b0baeafd38a6976f6209Affected
  • 1a80dbcb2dbaf6e4c216e62e30fa7d3daa8001ce to before fa97b8fed9896f1e89cb657513e483a152d4c382Affected
  • 1a80dbcb2dbaf6e4c216e62e30fa7d3daa8001ce to before 2884dc7d08d98a89d8d65121524bb7533183a63aAffected
  • 5d8d447777564b35f67000e7838e7ccb64d525c8Affected
  • 6.6.26 to before 6.6.35Affected
  • 6.8.5 to before 6.9Affected
LinuxLinux
  • 6.9Affected
  • before 6.9Not affected
  • 6.6.35 through 6.6.*Not affected
  • 6.9.6 through 6.9.*Not affected
  • 6.10 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.