CVE-2024-35860

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2024-35860", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-05-17T13:50:33.107Z", "datePublished": "2024-05-19T08:34:19.368Z", "dateUpdated": "2026-10-30T12:18:16.969Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-30T12:18:16.969Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: support deferring bpf_link dealloc to after RCU grace period\n\nBPF link for some program types is passed as a \"context\" which can be\nused by those BPF programs to look up additional information. E.g., for\nmulti-kprobes and multi-uprobes, link is used to fetch BPF cookie values.\n\nBecause of this runtime dependency, when bpf_link refcnt drops to zero\nthere could still be active BPF programs running accessing link data.\n\nThis patch adds generic support to defer bpf_link dealloc callback to\nafter RCU GP, if requested. This is done by exposing two different\ndeallocation callbacks, one synchronous and one deferred. If deferred\none is provided, bpf_link_free() will schedule dealloc_deferred()\ncallback to happen after RCU GP.\n\nBPF is using two flavors of RCU: \"classic\" non-sleepable one and RCU\ntasks trace one. The latter is used when sleepable BPF programs are\nused. bpf_link_free() accommodates that by checking underlying BPF\nprogram's sleepable flag, and goes either through normal RCU GP only for\nnon-sleepable, or through RCU tasks trace GP *and* then normal RCU GP\n(taking into account rcu_trace_implies_rcu_gp() optimization), if BPF\nprogram is sleepable.\n\nWe use this for multi-kprobe and multi-uprobe links, which dereference\nlink during program run. We also preventively switch raw_tp link to use\ndeferred dealloc callback, as upcoming changes in bpf-next tree expose\nraw_tp link data (specifically, cookie value) to BPF program at runtime\nas well."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerability is reached solely through the local `bpf()` syscall \u2014 `BPF_PROG_LOAD` plus `BPF_LINK_CREATE` for a kprobe_multi/uprobe_multi link, then closing the link fd while the probes fire. No network or remote-peer input is involved anywhere on the path.\nAC:L - The attacker controls both sides of the race: it picks which kernel/user functions are probed (including ones that block, so return-hooks fire arbitrarily late), drives them in a loop across all CPUs, and closes the link fd at will; three independent syzbot reproducers hit it in practice, so no condition outside attacker influence is required.\nPR:L - Creating these links needs CAP_BPF+CAP_PERFMON, which `bpf_token_capable()` grants at `ns_capable()` level to a delegated BPF token inside a container, and which ordinary non-root tracing/observability service accounts routinely hold \u2014 that is a low-privileged account, not administrative control of the host.\nUI:N - The whole sequence \u2014 load program, create link, trigger the probes, close the fd \u2014 happens inside the attacker's own process. No action by any other user or administrator is needed.\nS:U - The use-after-free and everything it corrupts stay inside the kernel's own memory and privilege domain; no hypervisor, IOMMU, or other security-authority boundary is crossed.\nC:H - `bpf_kprobe_multi_cookie()` bsearches the freed `addrs` array and returns `*cookie` from the freed `cookies` allocation directly to the running BPF program, which can exfiltrate it via a map \u2014 a read primitive over attacker-sprayed reclaimed slab, and the freed link is fully groomable.\nI:H - `kprobe_multi_link_prog_run()`/`uprobe_prog_run()` load `link->link.prog` out of freed memory and then indirect-call through it via `bpf_prog_run()`, and `fprobe_exit_handler()` calls `fp->exit_handler` from the same freed object \u2014 an attacker-controlled function-pointer dispatch giving control-flow hijack and full kernel-integrity compromise.\nA:H - Even without weaponization, dereferencing and calling through the freed link produces a KASAN slab-use-after-free splat and a wild indirect branch \u2014 an immediate oops or panic \u2014 and the attacker can repeat the create/trigger/close cycle indefinitely."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["include/linux/bpf.h", "kernel/bpf/syscall.c", "kernel/trace/bpf_trace.c"], "versions": [{"version": "0dcac272540613d41c05e89679e4ddb978b612f1", "lessThan": "ac48dc6ac9240f73bf08d29edf65c2deca93ee5d", "status": "affected", "versionType": "git"}, {"version": "0dcac272540613d41c05e89679e4ddb978b612f1", "lessThan": "876941f533e7b47fc69977fc4551c02f2d18af97", "status": "affected", "versionType": "git"}, {"version": "0dcac272540613d41c05e89679e4ddb978b612f1", "lessThan": "5d8d447777564b35f67000e7838e7ccb64d525c8", "status": "affected", "versionType": "git"}, {"version": "0dcac272540613d41c05e89679e4ddb978b612f1", "lessThan": "1a80dbcb2dbaf6e4c216e62e30fa7d3daa8001ce", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["include/linux/bpf.h", "kernel/bpf/syscall.c", "kernel/trace/bpf_trace.c"], "versions": [{"version": "5.18", "status": "affected"}, {"version": "0", "lessThan": "5.18", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.191", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.26", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.8.5", "lessThanOrEqual": "6.8.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.9", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.18", "versionEndExcluding": "6.1.191"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.18", "versionEndExcluding": "6.6.26"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.18", "versionEndExcluding": "6.8.5"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.18", "versionEndExcluding": "6.9"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/ac48dc6ac9240f73bf08d29edf65c2deca93ee5d"}, {"url": "https://git.kernel.org/stable/c/876941f533e7b47fc69977fc4551c02f2d18af97"}, {"url": "https://git.kernel.org/stable/c/5d8d447777564b35f67000e7838e7ccb64d525c8"}, {"url": "https://git.kernel.org/stable/c/1a80dbcb2dbaf6e4c216e62e30fa7d3daa8001ce"}], "title": "bpf: support deferring bpf_link dealloc to after RCU grace period", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T03:21:48.532Z"}, "title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/876941f533e7b47fc69977fc4551c02f2d18af97", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/5d8d447777564b35f67000e7838e7ccb64d525c8", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/1a80dbcb2dbaf6e4c216e62e30fa7d3daa8001ce", "tags": ["x_transferred"]}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-35860", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-10T15:41:33.868687Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T17:33:17.617Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/876941f533e7b47fc69977fc4551c02f2d18af97", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/5d8d447777564b35f67000e7838e7ccb64d525c8", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/1a80dbcb2dbaf6e4c216e62e30fa7d3daa8001ce", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T03:21:48.532Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-35860", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-10T15:41:33.868687Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T12:42:15.967Z"}}], "cna": {"title": "bpf: support deferring bpf_link dealloc to after RCU grace period", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerability is reached solely through the local `bpf()` syscall \u2014 `BPF_PROG_LOAD` plus `BPF_LINK_CREATE` for a kprobe_multi/uprobe_multi link, then closing the link fd while the probes fire. No network or remote-peer input is involved anywhere on the path.\nAC:L - The attacker controls both sides of the race: it picks which kernel/user functions are probed (including ones that block, so return-hooks fire arbitrarily late), drives them in a loop across all CPUs, and closes the link fd at will; three independent syzbot reproducers hit it in practice, so no condition outside attacker influence is required.\nPR:L - Creating these links needs CAP_BPF+CAP_PERFMON, which `bpf_token_capable()` grants at `ns_capable()` level to a delegated BPF token inside a container, and which ordinary non-root tracing/observability service accounts routinely hold \u2014 that is a low-privileged account, not administrative control of the host.\nUI:N - The whole sequence \u2014 load program, create link, trigger the probes, close the fd \u2014 happens inside the attacker's own process. No action by any other user or administrator is needed.\nS:U - The use-after-free and everything it corrupts stay inside the kernel's own memory and privilege domain; no hypervisor, IOMMU, or other security-authority boundary is crossed.\nC:H - `bpf_kprobe_multi_cookie()` bsearches the freed `addrs` array and returns `*cookie` from the freed `cookies` allocation directly to the running BPF program, which can exfiltrate it via a map \u2014 a read primitive over attacker-sprayed reclaimed slab, and the freed link is fully groomable.\nI:H - `kprobe_multi_link_prog_run()`/`uprobe_prog_run()` load `link->link.prog` out of freed memory and then indirect-call through it via `bpf_prog_run()`, and `fprobe_exit_handler()` calls `fp->exit_handler` from the same freed object \u2014 an attacker-controlled function-pointer dispatch giving control-flow hijack and full kernel-integrity compromise.\nA:H - Even without weaponization, dereferencing and calling through the freed link produces a KASAN slab-use-after-free splat and a wild indirect branch \u2014 an immediate oops or panic \u2014 and the attacker can repeat the create/trigger/close cycle indefinitely."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "0dcac272540613d41c05e89679e4ddb978b612f1", "lessThan": "ac48dc6ac9240f73bf08d29edf65c2deca93ee5d", "versionType": "git"}, {"status": "affected", "version": "0dcac272540613d41c05e89679e4ddb978b612f1", "lessThan": "876941f533e7b47fc69977fc4551c02f2d18af97", "versionType": "git"}, {"status": "affected", "version": "0dcac272540613d41c05e89679e4ddb978b612f1", "lessThan": "5d8d447777564b35f67000e7838e7ccb64d525c8", "versionType": "git"}, {"status": "affected", "version": "0dcac272540613d41c05e89679e4ddb978b612f1", "lessThan": "1a80dbcb2dbaf6e4c216e62e30fa7d3daa8001ce", "versionType": "git"}], "programFiles": ["include/linux/bpf.h", "kernel/bpf/syscall.c", "kernel/trace/bpf_trace.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5.18"}, {"status": "unaffected", "version": "0", "lessThan": "5.18", "versionType": "semver"}, {"status": "unaffected", "version": "6.1.191", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.26", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.8.5", "versionType": "semver", "lessThanOrEqual": "6.8.*"}, {"status": "unaffected", "version": "6.9", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["include/linux/bpf.h", "kernel/bpf/syscall.c", "kernel/trace/bpf_trace.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/ac48dc6ac9240f73bf08d29edf65c2deca93ee5d"}, {"url": "https://git.kernel.org/stable/c/876941f533e7b47fc69977fc4551c02f2d18af97"}, {"url": "https://git.kernel.org/stable/c/5d8d447777564b35f67000e7838e7ccb64d525c8"}, {"url": "https://git.kernel.org/stable/c/1a80dbcb2dbaf6e4c216e62e30fa7d3daa8001ce"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: support deferring bpf_link dealloc to after RCU grace period\n\nBPF link for some program types is passed as a \"context\" which can be\nused by those BPF programs to look up additional information. E.g., for\nmulti-kprobes and multi-uprobes, link is used to fetch BPF cookie values.\n\nBecause of this runtime dependency, when bpf_link refcnt drops to zero\nthere could still be active BPF programs running accessing link data.\n\nThis patch adds generic support to defer bpf_link dealloc callback to\nafter RCU GP, if requested. This is done by exposing two different\ndeallocation callbacks, one synchronous and one deferred. If deferred\none is provided, bpf_link_free() will schedule dealloc_deferred()\ncallback to happen after RCU GP.\n\nBPF is using two flavors of RCU: \"classic\" non-sleepable one and RCU\ntasks trace one. The latter is used when sleepable BPF programs are\nused. bpf_link_free() accommodates that by checking underlying BPF\nprogram's sleepable flag, and goes either through normal RCU GP only for\nnon-sleepable, or through RCU tasks trace GP *and* then normal RCU GP\n(taking into account rcu_trace_implies_rcu_gp() optimization), if BPF\nprogram is sleepable.\n\nWe use this for multi-kprobe and multi-uprobe links, which dereference\nlink during program run. We also preventively switch raw_tp link to use\ndeferred dealloc callback, as upcoming changes in bpf-next tree expose\nraw_tp link data (specifically, cookie value) to BPF program at runtime\nas well."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.191", "versionStartIncluding": "5.18"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.26", "versionStartIncluding": "5.18"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.8.5", "versionStartIncluding": "5.18"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.9", "versionStartIncluding": "5.18"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-30T12:18:16.969Z"}}}, "cveMetadata": {"cveId": "CVE-2024-35860", "state": "PUBLISHED", "dateUpdated": "2026-10-30T12:18:16.969Z", "dateReserved": "2024-05-17T13:50:33.107Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-05-19T08:34:19.368Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["include/linux/bpf.h", "kernel/bpf/syscall.c", "kernel/trace/bpf_trace.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "ac48dc6ac9240f73bf08d29edf65c2deca93ee5d", "status": "affected", "version": "0dcac272540613d41c05e89679e4ddb978b612f1", "versionType": "git"}, {"lessThan": "876941f533e7b47fc69977fc4551c02f2d18af97", "status": "affected", "version": "0dcac272540613d41c05e89679e4ddb978b612f1", "versionType": "git"}, {"lessThan": "5d8d447777564b35f67000e7838e7ccb64d525c8", "status": "affected", "version": "0dcac272540613d41c05e89679e4ddb978b612f1", "versionType": "git"}, {"lessThan": "1a80dbcb2dbaf6e4c216e62e30fa7d3daa8001ce", "status": "affected", "version": "0dcac272540613d41c05e89679e4ddb978b612f1", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["include/linux/bpf.h", "kernel/bpf/syscall.c", "kernel/trace/bpf_trace.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.18"}, {"lessThan": "5.18", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.191", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.26", "versionType": "semver"}, {"lessThanOrEqual": "6.8.*", "status": "unaffected", "version": "6.8.5", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.9", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "BAFF545A-B677-4A95-8623-C54ED5D40C3D", "versionEndExcluding": "6.6.26", "versionStartIncluding": "5.18", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "DBD6C99E-4250-4DFE-8447-FF2075939D10", "versionEndExcluding": "6.8.5", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.9:rc1:*:*:*:*:*:*", "matchCriteriaId": "22BEDD49-2C6D-402D-9DBF-6646F6ECD10B", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.9:rc2:*:*:*:*:*:*", "matchCriteriaId": "DF73CB2A-DFFD-46FB-9BFE-AA394F27EA37", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: support deferring bpf_link dealloc to after RCU grace period\n\nBPF link for some program types is passed as a \"context\" which can be\nused by those BPF programs to look up additional information. E.g., for\nmulti-kprobes and multi-uprobes, link is used to fetch BPF cookie values.\n\nBecause of this runtime dependency, when bpf_link refcnt drops to zero\nthere could still be active BPF programs running accessing link data.\n\nThis patch adds generic support to defer bpf_link dealloc callback to\nafter RCU GP, if requested. This is done by exposing two different\ndeallocation callbacks, one synchronous and one deferred. If deferred\none is provided, bpf_link_free() will schedule dealloc_deferred()\ncallback to happen after RCU GP.\n\nBPF is using two flavors of RCU: \"classic\" non-sleepable one and RCU\ntasks trace one. The latter is used when sleepable BPF programs are\nused. bpf_link_free() accommodates that by checking underlying BPF\nprogram's sleepable flag, and goes either through normal RCU GP only for\nnon-sleepable, or through RCU tasks trace GP *and* then normal RCU GP\n(taking into account rcu_trace_implies_rcu_gp() optimization), if BPF\nprogram is sleepable.\n\nWe use this for multi-kprobe and multi-uprobe links, which dereference\nlink during program run. We also preventively switch raw_tp link to use\ndeferred dealloc callback, as upcoming changes in bpf-next tree expose\nraw_tp link data (specifically, cookie value) to BPF program at runtime\nas well."}, {"lang": "es", "value": "En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: bpf: se admite el aplazamiento de la asignaci\u00f3n de bpf_link despu\u00e9s del per\u00edodo de gracia de RCU. El enlace BPF para algunos tipos de programas se pasa como un \"contexto\" que pueden utilizar esos programas BPF para buscar informaci\u00f3n adicional. Por ejemplo, para multi-kprobes y multi-uprobes, el enlace se utiliza para recuperar valores de cookies BPF. Debido a esta dependencia del tiempo de ejecuci\u00f3n, cuando bpf_link refcnt cae a cero, todav\u00eda podr\u00eda haber programas BPF activos ejecut\u00e1ndose y accediendo a los datos del enlace. Este parche agrega soporte gen\u00e9rico para diferir la devoluci\u00f3n de llamada de bpf_link dealloc despu\u00e9s de RCU GP, si se solicita. Esto se hace exponiendo dos devoluciones de llamada de desasignaci\u00f3n diferentes, una sincr\u00f3nica y otra diferida. Si se proporciona uno diferido, bpf_link_free() programar\u00e1 la devoluci\u00f3n de llamada de dealloc_deferred() para que se realice despu\u00e9s de RCU GP. BPF utiliza dos tipos de RCU: uno \"cl\u00e1sico\" que no se puede dormir y uno de seguimiento de tareas de RCU. Este \u00faltimo se utiliza cuando se utilizan programas BPF que se pueden dormir. bpf_link_free() se adapta a eso al verificar el indicador de suspensi\u00f3n del programa BPF subyacente, y pasa por la GP de RCU normal solo para los no dormidos, o a trav\u00e9s de tareas de RCU rastrean la GP *y* luego la GP de RCU normal (teniendo en cuenta la optimizaci\u00f3n de rcu_trace_implies_rcu_gp()), si El programa BPF se puede dormir. Usamos esto para enlaces multi-kprobe y multi-uprobe, que desreferencian el enlace durante la ejecuci\u00f3n del programa. Tambi\u00e9n cambiamos preventivamente el enlace raw_tp para usar la devoluci\u00f3n de llamada de dealloc diferida, ya que los pr\u00f3ximos cambios en el \u00e1rbol bpf-next tambi\u00e9n exponen los datos del enlace raw_tp (espec\u00edficamente, el valor de la cookie) al programa BPF en tiempo de ejecuci\u00f3n."}], "id": "CVE-2024-35860", "lastModified": "2026-10-30T13:17:26.693", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-35860", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-09-10T15:41:33.868687Z", "version": "2.0.3"}}]}, "published": "2024-05-19T09:15:07.603", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/1a80dbcb2dbaf6e4c216e62e30fa7d3daa8001ce"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/5d8d447777564b35f67000e7838e7ccb64d525c8"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/876941f533e7b47fc69977fc4551c02f2d18af97"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ac48dc6ac9240f73bf08d29edf65c2deca93ee5d"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/1a80dbcb2dbaf6e4c216e62e30fa7d3daa8001ce"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/5d8d447777564b35f67000e7838e7ccb64d525c8"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/876941f533e7b47fc69977fc4551c02f2d18af97"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: bpf: support deferring bpf_link dealloc to after RCU grace period", "id": "2281790", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2281790"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "details": ["In the Linux kernel, the following vulnerability has been resolved:\nbpf: support deferring bpf_link dealloc to after RCU grace period\nBPF link for some program types is passed as a \"context\" which can be\nused by those BPF programs to look up additional information. E.g., for\nmulti-kprobes and multi-uprobes, link is used to fetch BPF cookie values.\nBecause of this runtime dependency, when bpf_link refcnt drops to zero\nthere could still be active BPF programs running accessing link data.\nThis patch adds generic support to defer bpf_link dealloc callback to\nafter RCU GP, if requested. This is done by exposing two different\ndeallocation callbacks, one synchronous and one deferred. If deferred\none is provided, bpf_link_free() will schedule dealloc_deferred()\ncallback to happen after RCU GP.\nBPF is using two flavors of RCU: \"classic\" non-sleepable one and RCU\ntasks trace one. The latter is used when sleepable BPF programs are\nused. bpf_link_free() accommodates that by checking underlying BPF\nprogram's sleepable flag, and goes either through normal RCU GP only for\nnon-sleepable, or through RCU tasks trace GP *and* then normal RCU GP\n(taking into account rcu_trace_implies_rcu_gp() optimization), if BPF\nprogram is sleepable.\nWe use this for multi-kprobe and multi-uprobe links, which dereference\nlink during program run. We also preventively switch raw_tp link to use\ndeferred dealloc callback, as upcoming changes in bpf-next tree expose\nraw_tp link data (specifically, cookie value) to BPF program at runtime\nas well."], "name": "CVE-2024-35860", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Under investigation", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Under investigation", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Under investigation", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Under investigation", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-05-19T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-35860\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-35860\nhttps://lore.kernel.org/linux-cve-announce/2024051935-CVE-2024-35860-04fd@gregkh/T"], "threat_severity": "Low"}

{"created": "2025-07-12T15:42:27.602706+00:00", "updated": "2025-07-12T15:42:27.602764+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}