CVE-2024-41040

net/sched: Fix UAF when resolving a clash

State: Published
Severity: 9.8 Critical
Published: Jul 29, 2024
Updated: Aug 5, 2026
Reserved: Jul 12, 2024

Description

In the Linux kernel, the following vulnerability has been resolved:

net/sched: Fix UAF when resolving a clash

KASAN reports the following UAF:

BUG: KASAN: slab-use-after-free in tcf_ct_flow_table_process_conn+0x12b/0x380 [act_ct] Read of size 1 at addr ffff888c07603600 by task handler130/6469

Call Trace: <IRQ> dump_stack_lvl+0x48/0x70 print_address_description.constprop.0+0x33/0x3d0 print_report+0xc0/0x2b0 kasan_report+0xd0/0x120 __asan_load1+0x6c/0x80 tcf_ct_flow_table_process_conn+0x12b/0x380 [act_ct] tcf_ct_act+0x886/0x1350 [act_ct] tcf_action_exec+0xf8/0x1f0 fl_classify+0x355/0x360 [cls_flower] __tcf_classify+0x1fd/0x330 tcf_classify+0x21c/0x3c0 sch_handle_ingress.constprop.0+0x2c5/0x500 __netif_receive_skb_core.constprop.0+0xb25/0x1510 __netif_receive_skb_list_core+0x220/0x4c0 netif_receive_skb_list_internal+0x446/0x620 napi_complete_done+0x157/0x3d0 gro_cell_poll+0xcf/0x100 __napi_poll+0x65/0x310 net_rx_action+0x30c/0x5c0 __do_softirq+0x14f/0x491 __irq_exit_rcu+0x82/0xc0 irq_exit_rcu+0xe/0x20 common_interrupt+0xa1/0xb0 </IRQ> <TASK> asm_common_interrupt+0x27/0x40

Allocated by task 6469: kasan_save_stack+0x38/0x70 kasan_set_track+0x25/0x40 kasan_save_alloc_info+0x1e/0x40 __kasan_krealloc+0x133/0x190 krealloc+0xaa/0x130 nf_ct_ext_add+0xed/0x230 [nf_conntrack] tcf_ct_act+0x1095/0x1350 [act_ct] tcf_action_exec+0xf8/0x1f0 fl_classify+0x355/0x360 [cls_flower] __tcf_classify+0x1fd/0x330 tcf_classify+0x21c/0x3c0 sch_handle_ingress.constprop.0+0x2c5/0x500 __netif_receive_skb_core.constprop.0+0xb25/0x1510 __netif_receive_skb_list_core+0x220/0x4c0 netif_receive_skb_list_internal+0x446/0x620 napi_complete_done+0x157/0x3d0 gro_cell_poll+0xcf/0x100 __napi_poll+0x65/0x310 net_rx_action+0x30c/0x5c0 __do_softirq+0x14f/0x491

Freed by task 6469: kasan_save_stack+0x38/0x70 kasan_set_track+0x25/0x40 kasan_save_free_info+0x2b/0x60 ____kasan_slab_free+0x180/0x1f0 __kasan_slab_free+0x12/0x30 slab_free_freelist_hook+0xd2/0x1a0 __kmem_cache_free+0x1a2/0x2f0 kfree+0x78/0x120 nf_conntrack_free+0x74/0x130 [nf_conntrack] nf_ct_destroy+0xb2/0x140 [nf_conntrack] __nf_ct_resolve_clash+0x529/0x5d0 [nf_conntrack] nf_ct_resolve_clash+0xf6/0x490 [nf_conntrack] __nf_conntrack_confirm+0x2c6/0x770 [nf_conntrack] tcf_ct_act+0x12ad/0x1350 [act_ct] tcf_action_exec+0xf8/0x1f0 fl_classify+0x355/0x360 [cls_flower] __tcf_classify+0x1fd/0x330 tcf_classify+0x21c/0x3c0 sch_handle_ingress.constprop.0+0x2c5/0x500 __netif_receive_skb_core.constprop.0+0xb25/0x1510 __netif_receive_skb_list_core+0x220/0x4c0 netif_receive_skb_list_internal+0x446/0x620 napi_complete_done+0x157/0x3d0 gro_cell_poll+0xcf/0x100 __napi_poll+0x65/0x310 net_rx_action+0x30c/0x5c0 __do_softirq+0x14f/0x491

The ct may be dropped if a clash has been resolved but is still passed to the tcf_ct_flow_table_process_conn function for further usage. This issue can be fixed by retrieving ct from skb again after confirming conntrack.

Scores

CVSS	Score	Vector	Source
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	f07c548314776231f0d47d73ec6caa5b17e876e8 to before b81a523d54ea689414f67c9fb81a5b917a41ed55Affected 0cc254e5aa37cf05f65bcdcdc0ac5c58010feb33 to before 2b4d68df3f57ea746c430941ba9c03d7d8b5a23fAffected 0cc254e5aa37cf05f65bcdcdc0ac5c58010feb33 to before 4e71b10a100861fb27d9c5755dfd68f615629faeAffected 0cc254e5aa37cf05f65bcdcdc0ac5c58010feb33 to before 799a34901b634008db4a7ece3900e2b971d4c932Affected 0cc254e5aa37cf05f65bcdcdc0ac5c58010feb33 to before ef472cc6693b16b202a916482df72f35d94bd69eAffected 0cc254e5aa37cf05f65bcdcdc0ac5c58010feb33 to before 26488172b0292bed837b95a006a3f3431d1898c3Affected 30822781c89943b6a3ed122324ceb37cea7042a3Affected 5.10.43 to before 5.10.222Affected 5.12.10 to before 5.13Affected
LinuxLinux	5.13Affected before 5.13Not affected 5.10.222 through 5.10.Not affected 5.15.163 through 5.15.Not affected 6.1.100 through 6.1.Not affected 6.6.41 through 6.6.Not affected 6.9.10 through 6.9.*Not affected 6.10 and laterNot affected

Product

Versions

LinuxLinux

f07c548314776231f0d47d73ec6caa5b17e876e8 to before b81a523d54ea689414f67c9fb81a5b917a41ed55Affected
0cc254e5aa37cf05f65bcdcdc0ac5c58010feb33 to before 2b4d68df3f57ea746c430941ba9c03d7d8b5a23fAffected
0cc254e5aa37cf05f65bcdcdc0ac5c58010feb33 to before 4e71b10a100861fb27d9c5755dfd68f615629faeAffected
0cc254e5aa37cf05f65bcdcdc0ac5c58010feb33 to before 799a34901b634008db4a7ece3900e2b971d4c932Affected
0cc254e5aa37cf05f65bcdcdc0ac5c58010feb33 to before ef472cc6693b16b202a916482df72f35d94bd69eAffected
0cc254e5aa37cf05f65bcdcdc0ac5c58010feb33 to before 26488172b0292bed837b95a006a3f3431d1898c3Affected
30822781c89943b6a3ed122324ceb37cea7042a3Affected
5.10.43 to before 5.10.222Affected
5.12.10 to before 5.13Affected

LinuxLinux

5.13Affected
before 5.13Not affected
5.10.222 through 5.10.*Not affected
5.15.163 through 5.15.*Not affected
6.1.100 through 6.1.*Not affected
6.6.41 through 6.6.*Not affected
6.9.10 through 6.9.*Not affected
6.10 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.