CVE-2024-56675: bpf: Fix UAF via mismatching bpf_prog/attachment RCU flavors

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-12-27 · updated 2026-06-17
Weakness: CWE-416

Description

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix UAF via mismatching bpf_prog/attachment RCU flavors Uprobes always use bpf_prog_run_array_uprobe() under tasks-trace-RCU protection. But it is possible to attach a non-sleepable BPF program to a uprobe, and non-sleepable BPF programs are freed via normal RCU (see __bpf_prog_put_noref()). This leads to UAF of the bpf_prog because a normal RCU grace period does not imply a tasks-trace-RCU grace period. Fix it by explicitly waiting for a tasks-trace-RCU grace period after removing the attachment of a bpf_prog to a perf_event.

Affected products

Linux kernel: from 6.0 before 6.1.121; from 6.2 before 6.6.67; from 6.7 before 6.12.6; 6.13-rc1, 6.13-rc2 — fixed in 6.1.121, 6.12.6, 6.6.67

How to fix

Upgrade to a fixed version: Linux kernel 6.1.121, 6.12.6, 6.6.67. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2024-56675 or the next vulnerability affects your stack