CVE-2024-35955: Linux Kernel Use-After-Free Vulnerability

CVE-2024-35955 Overview

CVE-2024-35955 is a use-after-free vulnerability [CWE-416] in the Linux kernel's kprobes subsystem. The flaw exists in the check_kprobe_address_safe() function, which handles kprobe registration against kernel and module text addresses. When a module transitions through its unload states (MODULE_STATE_LIVE → MODULE_STATE_GOING → MODULE_STATE_UNFORMED), a race condition allows kprobe registration to succeed against memory that has already been freed. An attacker with local privileges to register kprobes can trigger arm_kprobe() to modify non-existent module text, resulting in memory corruption within kernel context.

Critical Impact
Successful exploitation can lead to kernel memory corruption, privilege escalation, or denial of service on affected Linux systems.

Affected Products

Linux Kernel (multiple stable branches prior to the fix)
Linux Kernel 6.9-rc1, 6.9-rc2, 6.9-rc3
Debian Linux 10.0

Discovery Timeline

2024-05-20 - CVE-2024-35955 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-35955

Vulnerability Analysis

The vulnerability resides in the kernel's kprobes (kernel probes) infrastructure, which allows dynamic instrumentation of arbitrary kernel instructions. During kprobe registration, check_kprobe_address_safe() validates that the target address is safe to probe by calling is_module_text_address() and __module_text_address() separately.

Both helpers only return valid results for modules in MODULE_STATE_LIVE or MODULE_STATE_GOING. Because the module state can advance to MODULE_STATE_UNFORMED between the two calls, the first check may succeed while the second returns NULL. The kprobes code treats a NULL result as an indication that the address belongs to core kernel text and proceeds with registration.

When arm_kprobe() subsequently executes, it modifies memory that the module unload path has already released, corrupting the kernel heap or triggering undefined behavior. See the Kernel Git Commit 5062d1f for the upstream fix.

Root Cause

The root cause is a time-of-check to time-of-use (TOCTOU) race between kprobe address validation and module unloading. The two separate lookups against module text ranges are not atomic with respect to module state transitions. The fix consolidates validation into a single __module_text_address() call combined with try_module_get(), which only succeeds when the module remains in MODULE_STATE_LIVE, preventing the race window.

Attack Vector

Exploitation requires local privileges sufficient to register kprobes, typically CAP_SYS_ADMIN or root, combined with the ability to trigger module loading and unloading. An attacker races kprobe registration against module unload to force the kernel to arm a probe on freed module text. The corruption primitive can be shaped into privilege escalation or a reliable kernel panic.

No public proof-of-concept exploit is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Technical details of the vulnerable code path are documented in the upstream commit series referenced by the Debian LTS Announcement #17.

Detection Methods for CVE-2024-35955

Indicators of Compromise

Unexpected kernel oops, panics, or KASAN use-after-free reports referencing arm_kprobe, check_kprobe_address_safe, or module unload paths.
Repeated init_module and delete_module syscalls from the same process in short succession, paired with perf_event_open or writes to /sys/kernel/debug/tracing/kprobe_events.
Unexplained kernel memory corruption warnings in dmesg on hosts that permit unprivileged module operations.

Detection Strategies

Audit use of the perf_event_open syscall with kprobe attributes and writes to tracing filesystem entries under /sys/kernel/tracing/kprobe_events.
Monitor for processes that both interact with the kprobes interface and invoke module management syscalls within the same execution context.
Enable KASAN (Kernel Address Sanitizer) on test kernels to surface use-after-free conditions during regression testing.

Monitoring Recommendations

Forward kernel logs, auditd events, and syscall telemetry to a centralized SIEM for correlation of kprobe and module activity.
Alert on any non-service accounts holding CAP_SYS_ADMIN that touch kprobe or module interfaces.
Track kernel version inventory to identify hosts running unpatched builds within the affected ranges.

How to Mitigate CVE-2024-35955

Immediate Actions Required

Apply distribution kernel updates that include the upstream fix commits referenced in the vendor advisories.
Restrict CAP_SYS_ADMIN and disable unnecessary module loading on production hosts.
Disable the kprobes interface (CONFIG_KPROBES=n) on systems that do not require dynamic tracing.

Patch Information

The fix is applied across multiple stable kernel branches. Reference commits include Kernel Git Commit 5062d1f, Kernel Git Commit 2df2dd2, and Kernel Git Commit d15023f. Debian users should install updates described in Debian LTS Announcement #17 and Debian LTS Announcement #20. Industrial operators should review Siemens Security Advisory SSA-265688 and Siemens Security Advisory SSA-613116.

Workarounds

Set kernel.kptr_restrict=2 and kernel.perf_event_paranoid=3 via sysctl to limit unprivileged access to kernel pointers and perf features.
Use module signing enforcement (CONFIG_MODULE_SIG_FORCE=y) to restrict which modules can be loaded and unloaded on the system.
Where feasible, blacklist unused kernel modules to reduce the attack surface for the race condition.

bash

# Configuration example: harden kprobes and module handling
sysctl -w kernel.kptr_restrict=2
sysctl -w kernel.perf_event_paranoid=3
sysctl -w kernel.unprivileged_bpf_disabled=1

# Verify running kernel version against patched builds
uname -r