CVE-2024-26625 – This is a use-after-free vulnerability in the L... (How to Fix)

Q: What is the severity of CVE-2024-26625?

CVE-2024-26625 has a CVSS score of 7.8 (HIGH). This is a use-after-free vulnerability in the Linux kernel's LLC (Logical Link Control) subsystem. When a closed LLC socket is improperly handled, it can lead to memory corruption and potential kernel crashes or privilege escalation. All Linux systems using affected kernel versions are vulnerable.

📋 TL;DR

This is a use-after-free vulnerability in the Linux kernel's LLC (Logical Link Control) subsystem. When a closed LLC socket is improperly handled, it can lead to memory corruption and potential kernel crashes or privilege escalation. All Linux systems using affected kernel versions are vulnerable.

💻 Affected Systems

Products:

Linux kernel

Versions: Kernel versions before the fix commits (specific versions vary by distribution, generally pre-6.8-rc1)

Operating Systems: All Linux distributions using vulnerable kernel versions

Default Config Vulnerable: ⚠️ Yes

Notes: Requires LLC protocol support (CONFIG_LLC), which is commonly enabled in standard kernels.

📦 What is this software?

Debian Linux by Debian

View all CVEs affecting Debian Linux →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Kernel panic leading to system crash, or potential privilege escalation to root if an attacker can control the freed memory region.

🟠

Likely Case

System instability, kernel crashes, or denial of service affecting network functionality.

🟢

If Mitigated

Limited impact if systems are patched or have proper kernel hardening features enabled.

🌐 Internet-Facing: MEDIUM - Requires network access to LLC sockets, which are less common than TCP/UDP but still present.

🏢 Internal Only: MEDIUM - Local attackers could potentially exploit this if they have access to create LLC sockets.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: HIGH

Exploitation requires triggering specific LLC socket operations and timing conditions. The vulnerability was discovered through syzbot fuzzing.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Fixed in kernel commits: 3151051b787f7cd7e3329ea0016eb9113c248812, 64babb17e8150771c58575d8f93a35c5296b499f, 6b950c712a9a05cdda4aea7fcb2848766576c11b, 8e51f084b5716653f19e291ed5f026791d4b3ed4, 9c333d9891f34cea8af1b229dc754552304c8eee

Vendor Advisory: https://git.kernel.org/stable/c/3151051b787f7cd7e3329ea0016eb9113c248812

Restart Required: Yes

Instructions:

1. Update to a patched kernel version from your distribution vendor. 2. Reboot the system to load the new kernel. 3. Verify the kernel version after reboot.

🔧 Temporary Workarounds

Disable LLC module

linux

Unload the LLC kernel module if not needed

sudo rmmod llc

Prevent module loading

linux

Blacklist LLC module to prevent loading

echo 'blacklist llc' | sudo tee /etc/modprobe.d/blacklist-llc.conf

🧯 If You Can't Patch

Restrict user access to prevent creation of raw sockets
Implement kernel hardening features like KASAN to detect exploitation attempts

🔍 How to Verify

Check if Vulnerable:

Check kernel version and if LLC module is loaded: uname -r && lsmod | grep llc

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version is after the fix commits and test LLC socket operations

📡 Detection & Monitoring

Log Indicators:

Kernel panic messages
KASAN reports of use-after-free
System crashes with call traces involving sock_wfree or llc

Network Indicators:

Unusual LLC protocol traffic
Failed socket operations

SIEM Query:

kernel: *KASAN* *use-after-free* OR kernel: *BUG* *llc* OR kernel: *sock_wfree*

📊 Metadata

CVE ID: CVE-2024-26625

CVSS v3 Score: 7.8 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-416

Published: March 6, 2024

Last Updated: January 7, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2024-26625, you might also want to check these: