CVE-2024-35887: ax25: fix use-after-free bugs caused by ax25_ds_del_timer

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-05-19 · updated 2026-09-14
Weakness: CWE-416

Description

In the Linux kernel, the following vulnerability has been resolved: ax25: fix use-after-free bugs caused by ax25_ds_del_timer When the ax25 device is detaching, the ax25_dev_device_down() calls ax25_ds_del_timer() to cleanup the slave_timer. When the timer handler is running, the ax25_ds_del_timer() that calls del_timer() in it will return directly. As a result, the use-after-free bugs could happen, one of the scenarios is shown below: (Thread 1) | (Thread 2) | ax25_ds_timeout() ax25_dev_device_down() | ax25_ds_del_timer() | del_timer() | ax25_dev_put() //FREE | | ax25_dev-> //USE In order to mitigate bugs, when the device is detaching, use timer_shutdown_sync() to stop the timer.

Affected products

Linux kernel: from 2.6.12 before 6.6.26; from 6.7 before 6.8.5; 6.9-rc1, 6.9-rc2 — fixed in 6.6.26, 6.8.5

How to fix

Upgrade to a fixed version: Linux kernel 6.6.26, 6.8.5. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2024-35887 or the next vulnerability affects your stack