CVE-2024-27394 Overview
CVE-2024-27394 is a use-after-free vulnerability [CWE-416] in the Linux kernel's TCP Authentication Option (TCP-AO) implementation. The flaw resides in the tcp_ao_connect_init function, where an hlist_for_each_entry_rcu traversal calls call_rcu outside of an RCU read critical section. This allows the RCU grace period to elapse mid-traversal, freeing a key that the loop still references. A local attacker with low privileges can trigger the condition to corrupt kernel memory, escalate privileges, or destabilize the host. The issue affects Linux kernel version 6.9 release candidates rc1 through rc5.
Critical Impact
Local exploitation can lead to kernel memory corruption with high impact on confidentiality, integrity, and availability of affected Linux hosts.
Affected Products
- Linux kernel 6.9-rc1 through 6.9-rc5
- Linux distributions shipping pre-release 6.9 kernels
- Systems with TCP Authentication Option (TCP-AO) enabled
Discovery Timeline
- 2024-05-14 - CVE-2024-27394 published to NVD
- 2026-08-04 - Last updated in NVD database
Technical Details for CVE-2024-27394
Vulnerability Analysis
The vulnerability exists in the Linux kernel's TCP-AO subsystem, which provides authenticated TCP sessions using cryptographic keys. During connection initialization, tcp_ao_connect_init iterates through a linked list of TCP-AO keys using the hlist_for_each_entry_rcu macro. Inside this traversal, the code invokes call_rcu to schedule deferred freeing of key objects.
The traversal is not wrapped in an RCU read-side critical section, so the RCU grace period can complete while the loop is still active. When the grace period ends, call_rcu callbacks execute and free the key memory. The loop then dereferences a freed pointer, triggering a use-after-free condition. The upstream fix replaces hlist_for_each_entry_rcu with hlist_for_each_entry_safe, which is designed to tolerate node removal during iteration.
Root Cause
The root cause is improper synchronization between list traversal and deferred memory reclamation. RCU-protected list traversals must occur within an rcu_read_lock()/rcu_read_unlock() region to guarantee that referenced nodes remain valid. Because tcp_ao_connect_init performs concurrent modification via call_rcu outside such a region, the safety invariants of hlist_for_each_entry_rcu are violated.
Attack Vector
Exploitation requires local access with low privileges and no user interaction. An attacker with the ability to establish or manipulate TCP sockets configured with TCP-AO keys can influence the timing of key removal and connection initialization. Successful exploitation yields kernel-mode read/write primitives suitable for privilege escalation or system crash.
No public proof-of-concept exploit is currently available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. See the Kernel Git Commit Log for the patch reference.
Detection Methods for CVE-2024-27394
Indicators of Compromise
- Unexpected kernel oops or panic messages referencing tcp_ao_connect_init or RCU callback failures in dmesg and /var/log/kern.log
- KASAN (Kernel Address Sanitizer) reports flagging use-after-free in the TCP-AO code path on debug kernels
- Unexplained privilege escalation events on hosts running Linux 6.9 release candidate kernels
Detection Strategies
- Inventory Linux hosts and identify systems running 6.9-rc1 through 6.9-rc5 using uname -r
- Audit sockets configured with TCP-AO keys via ss and setsockopt telemetry to identify exposed workloads
- Correlate kernel crash telemetry with process activity to identify local users triggering TCP-AO code paths
Monitoring Recommendations
- Forward kernel logs to a centralized SIEM and alert on TCP-AO or RCU-related stack traces
- Monitor for repeated socket creation with TCP-AO options from non-administrative accounts
- Track kernel version drift across the fleet to catch hosts pinned to vulnerable release candidate builds
How to Mitigate CVE-2024-27394
Immediate Actions Required
- Upgrade affected Linux hosts to a kernel release containing commits 80e679b352c3ce5158f3f778cfb77eb767e586fb and ca4fb6c6764b3f75b4f5aa81db1536291897ff7f
- Avoid deploying 6.9 release candidate kernels in production and standardize on stable kernel branches
- Restrict local shell access on multi-tenant systems to reduce the local attack surface
Patch Information
The fix replaces hlist_for_each_entry_rcu with hlist_for_each_entry_safe in tcp_ao_connect_init, eliminating the use-after-free condition. Patch details are available in the Kernel Git Commit Log and the companion commit. Downstream distribution kernels released after May 2024 incorporate the fix.
Workarounds
- Disable TCP Authentication Option usage on hosts that do not require it by avoiding TCP_AO_ADD_KEY socket options
- Apply mandatory access controls such as SELinux or AppArmor to limit which processes can configure TCP-AO keys
- Enforce kernel lockdown mode where feasible to reduce exploitability of kernel memory corruption
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
