CVE-2024-40954 – This CVE describes a use-after-free vulnerabili... (How to Fix)

Q: What is the severity of CVE-2024-40954?

CVE-2024-40954 has a CVSS score of 7.8 (HIGH). This CVE describes a use-after-free vulnerability in the Linux kernel's networking subsystem where socket creation failure leaves a dangling pointer. Attackers can exploit this to cause kernel memory corruption, potentially leading to system crashes or privilege escalation. Systems running vulnerable Linux kernel versions with BPF/eBPF capabilities are affected.

📋 TL;DR

This CVE describes a use-after-free vulnerability in the Linux kernel's networking subsystem where socket creation failure leaves a dangling pointer. Attackers can exploit this to cause kernel memory corruption, potentially leading to system crashes or privilege escalation. Systems running vulnerable Linux kernel versions with BPF/eBPF capabilities are affected.

💻 Affected Systems

Products:

Linux Kernel

Versions: Versions before the fix commits (specific versions vary by distribution)

Operating Systems: Linux distributions using vulnerable kernel versions

Default Config Vulnerable: ⚠️ Yes

Notes: Requires CONFIG_BPF_SYSCALL enabled and ability to load BPF programs. Most modern distributions have this enabled by default.

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Kernel panic leading to denial of service, or potential privilege escalation allowing attackers to execute arbitrary code with kernel privileges.

🟠

Likely Case

System instability, crashes, or denial of service when specific network operations trigger the vulnerable code path.

🟢

If Mitigated

Minimal impact if kernel hardening features like KASAN, KPTI, or SMAP/SMEP are enabled and properly configured.

🌐 Internet-Facing: MEDIUM - Requires specific conditions (BPF probe + network operation) but could be triggered remotely via network traffic.

🏢 Internal Only: MEDIUM - Same technical requirements but lower attack surface from internal networks.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: HIGH

Exploitation requires ability to load BPF programs (typically requires CAP_BPF or root privileges) and trigger specific network operations.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Fixed in kernel commits: 454c454ed645fed051216b79622f7cb69c1638f5, 5dfe2408fd7dc4d2e7ac38a116ff0a37b1cfd3b9, 6cd4a78d962bebbaf8beb7d2ead3f34120e3f7b2, 78e4aa528a7b1204219d808310524344f627d069, 893eeba94c40d513cd0fe6539330ebdaea208c0e

Vendor Advisory: https://git.kernel.org/stable/c/454c454ed645fed051216b79622f7cb69c1638f5

Restart Required: Yes

Instructions:

1. Update Linux kernel to version containing the fix. 2. Check your distribution's security advisories for specific patched versions. 3. Reboot system after kernel update.

🔧 Temporary Workarounds

Disable BPF system call

linux

Prevents loading of BPF programs that could trigger the vulnerability

sysctl -w kernel.unprivileged_bpf_disabled=1
echo 1 > /proc/sys/kernel/unprivileged_bpf_disabled

Restrict BPF capabilities

linux

Limit which users can load BPF programs using Linux capabilities

setcap -r /usr/bin/bpftool
capsh --drop=cap_bpf -- -c 'your_command'

🧯 If You Can't Patch

Implement strict BPF program loading restrictions using Linux capabilities
Enable kernel hardening features like KASAN, KPTI, and SMAP/SMEP to reduce exploit impact

🔍 How to Verify

Check if Vulnerable:

Check kernel version and verify if BPF is enabled: uname -r && grep CONFIG_BPF_SYSCALL /boot/config-$(uname -r)

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version is patched: uname -r should show version after fix commits were merged

📡 Detection & Monitoring

Log Indicators:

Kernel panic messages
KASAN reports of use-after-free in sock_gen_cookie or __sock_release
System crashes during network operations

Network Indicators:

Unusual traceroute or socket creation patterns from single source
Multiple failed socket creation attempts

SIEM Query:

source="kernel" AND ("KASAN: slab-use-after-free" OR "BUG: KASAN" OR "sock_gen_cookie" OR "__sock_release")

📊 Metadata

CVE ID: CVE-2024-40954

CVSS v3 Score: 7.8 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-416

Published: July 12, 2024

Last Updated: November 3, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2024-40954, you might also want to check these: