CVE-2024-27394 Overview
CVE-2024-27394 is a use-after-free vulnerability in the Linux kernel's TCP Authentication Option (TCP-AO) subsystem, specifically in the tcp_ao_connect_init function. The flaw exists because call_rcu, invoked during an hlist_for_each_entry_rcu traversal, is not part of the RCU read critical section. The RCU grace period can elapse mid-traversal, causing the key to be freed while still referenced. The vulnerability affects Linux kernel 6.9 release candidates and earlier development versions and is classified under [CWE-416]. Local attackers with limited privileges can trigger the condition to compromise confidentiality, integrity, and availability.
Critical Impact
Local privilege escalation and kernel memory corruption through use-after-free in the TCP-AO connect path, enabling full host compromise on unpatched systems.
Affected Products
- Linux Kernel 6.9-rc1 through 6.9-rc5
- Linux Kernel builds with TCP Authentication Option (TCP-AO) enabled
- Distributions shipping pre-release 6.9 kernels
Discovery Timeline
- 2024-05-14 - CVE-2024-27394 published to NVD
- 2026-08-04 - Last updated in NVD database
Technical Details for CVE-2024-27394
Vulnerability Analysis
The vulnerability resides in tcp_ao_connect_init, a function in the Linux kernel's TCP stack that initializes TCP Authentication Option state during connection setup. The function iterates over a hash list of TCP-AO keys using the hlist_for_each_entry_rcu macro, which requires the traversal to occur inside an RCU read-side critical section for memory-safety guarantees.
During the traversal, the code invokes call_rcu to schedule deferred freeing of key entries. Because call_rcu itself is not part of the RCU read-side critical section, the RCU grace period can complete before the iterator advances to the next node. The next pointer dereference then reads memory that has already been reclaimed, resulting in a use-after-free condition on kernel heap objects.
Exploiting this flaw allows a local unprivileged user to corrupt kernel memory. Successful exploitation can escalate privileges, disclose kernel memory, or cause a denial of service through kernel panic.
Root Cause
The root cause is incorrect use of RCU synchronization primitives. hlist_for_each_entry_rcu guarantees safe iteration only while inside an RCU read-side critical section, but call_rcu operates outside that guarantee. The fix, applied in commits 80e679b352c3ce5158f3f778cfb77eb767e586fb and ca4fb6c6764b3f75b4f5aa81db1536291897ff7f, replaces the RCU iterator with hlist_for_each_entry_safe, which caches the next pointer before the current node can be freed.
Attack Vector
Exploitation requires local access with low privileges and no user interaction. An attacker races the RCU grace period during TCP-AO connection initialization to force dereference of freed key memory. The attacker must be able to invoke the affected code path, typically by creating TCP sockets with TCP-AO keys and triggering connect operations under controlled timing.
No public proof-of-concept exploit is currently available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Detection Methods for CVE-2024-27394
Indicators of Compromise
- Unexpected kernel oops or panic messages referencing tcp_ao_connect_init or TCP-AO key structures in dmesg and /var/log/kern.log.
- KASAN or KFENCE reports flagging use-after-free access in the TCP-AO subsystem.
- Unexplained kernel memory corruption alerts followed by anomalous process privilege changes.
Detection Strategies
- Inventory running kernels and flag any host executing Linux 6.9-rc1 through 6.9-rc5 or unpatched pre-release builds.
- Enable kernel address sanitizers (KASAN) in test environments to surface use-after-free triggers in the TCP-AO path.
- Correlate kernel crash telemetry with local user session activity to identify race-condition exploitation attempts.
Monitoring Recommendations
- Ship kernel logs and audit events to a centralized SIEM and alert on kernel oops involving networking symbols.
- Monitor for local users invoking setsockopt with TCP_AO_ADD_KEY at unusual rates.
- Track uptime and unplanned reboots on Linux hosts running affected kernel versions.
How to Mitigate CVE-2024-27394
Immediate Actions Required
- Upgrade to a Linux kernel release that includes commits 80e679b352c3ce5158f3f778cfb77eb767e586fb and ca4fb6c6764b3f75b4f5aa81db1536291897ff7f.
- Remove or downgrade any 6.9 release-candidate kernels from production and lab systems.
- Restrict local shell access on hosts that cannot be patched immediately.
Patch Information
The upstream fix replaces hlist_for_each_entry_rcu with hlist_for_each_entry_safe in tcp_ao_connect_init, preventing the traversal from dereferencing a node freed during an intermediate call_rcu. Patch details are available at the Kernel Git Commit 80e679b3 and Kernel Git Commit ca4fb6c6 advisories.
Workarounds
- Disable TCP Authentication Option support by building or booting a kernel without CONFIG_TCP_AO where operationally acceptable.
- Restrict CAP_NET_ADMIN and local socket creation to trusted service accounts to reduce the attack surface.
- Apply seccomp or LSM policies that block untrusted binaries from configuring TCP-AO keys.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
