#VU88938 Race condition in Linux kernel - CVE-2024-26737

Vulnerability identifier: #VU88938

Vulnerability risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-26737

CWE-ID: CWE-362

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a race condition between the bpf_timer_cancel_and_free and bpf_timer_cancel calls in kernel/bpf/helpers.c. A local user can exploit the race and escalate privileges on the system.

Mitigation
Install updates from vendor's website.

Vulnerable software versions

Linux kernel: All versions

---

External links
http://git.kernel.org/stable/c/5268bb02107b9eedfdcd51db75b407d10043368c
http://git.kernel.org/stable/c/addf5e297e6cbf5341f9c07720693ca9ba0057b5
http://git.kernel.org/stable/c/8327ed12e8ebc5436bfaa1786c49988894f9c8a6
http://git.kernel.org/stable/c/7d80a9e745fa5b47da3bca001f186c02485c7c33
http://git.kernel.org/stable/c/0281b919e175bb9c3128bd3872ac2903e9436e3f

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.