CVE-2024-36899: Linux Kernel Use-After-Free Vulnerability

CVE-2024-36899 Overview

CVE-2024-36899 is a use-after-free vulnerability in the Linux kernel's gpiolib character device (cdev) subsystem. The flaw resides in the lineinfo_changed_notify notifier path and stems from a race condition [CWE-362] between GPIO chip device file closure and GPIO line release. When gpio_chrdev_release() frees cdev->watched_lines via bitmap_free() while another thread holds the notifier chain's read semaphore, the notifier callback can access freed memory. The issue affects Linux kernel version 6.9 release candidates and earlier stable branches. Debian LTS and Siemens have issued advisories referencing this vulnerability.

Critical Impact
A local, low-privileged attacker can trigger a race condition in the GPIO character device driver, leading to kernel memory corruption and potential local privilege escalation or denial of service.

Affected Products

Linux kernel 6.9-rc1 through 6.9-rc7
Linux kernel stable branches prior to fixes 02f6b0e, 95ca7c9, and ca710b5
Debian LTS distributions (see Debian LTS advisories) and Siemens industrial products (see SSA-265688)

Discovery Timeline

2024-05-30 - CVE-2024-36899 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-36899

Vulnerability Analysis

The vulnerability is a classic use-after-free triggered by a race between two concurrent GPIO operations. When userspace closes a GPIO chip character device, gpio_chrdev_release() frees the watched_lines bitmap and then attempts to unregister the lineinfo_changed_nb notifier chain. The unregistration path blocks while waiting to acquire the notifier chain's write rwsem.

Concurrently, a separate GPIO line release (for example, st54spi_gpio_dev_release() calling gpio_free()) proceeds through gpiod_free_commit() and gpiod_line_state_notify(). That path holds the notifier chain's read rwsem and invokes lineinfo_changed_notify(), which calls test_bit() against the already-freed cdev->watched_lines bitmap. The side effect is a spurious GPIO line event and kernel memory corruption. Exploitation requires local access and correctly timed GPIO operations.

Root Cause

The root cause is incorrect ordering of cleanup operations in gpio_chrdev_release(). The bitmap_free(cdev->watched_lines) call occurs before blocking_notifier_chain_unregister() completes, allowing in-flight notifier callbacks holding the read rwsem to dereference freed memory. This is a time-of-check to time-of-use pattern in kernel synchronization between reference-counted resources and RCU-style notifier chains.

Attack Vector

A local attacker with permission to open a GPIO character device (typically /dev/gpiochipN) can race the close(2) syscall against concurrent GPIO line release operations to trigger the free-then-use sequence. The vulnerability requires the ability to open the GPIO chrdev and induce concurrent line state changes, which is feasible on embedded Linux systems, industrial controllers, and single-board computers where GPIO device nodes may be accessible to service accounts.

No verified public proof-of-concept code is available. The technical details of the fix are documented in the upstream kernel commits referenced by the Kernel Git Commit 02f6b0e, Kernel Git Commit 95ca7c9, and Kernel Git Commit ca710b5.

Detection Methods for CVE-2024-36899

Indicators of Compromise

Kernel log entries referencing KASAN: use-after-free in lineinfo_changed_notify or gpio_chrdev_release
Unexpected process crashes or kernel oops messages associated with /dev/gpiochip* handles
Anomalous GPIO line change events delivered to processes that recently closed the GPIO chrdev

Detection Strategies

Enable KASAN (Kernel Address Sanitizer) on test and staging kernels to surface the race deterministically
Audit running kernel versions against the fixed commits 02f6b0e, 95ca7c9, and ca710b5 using package inventory tooling
Monitor dmesg and journald for kernel warnings involving gpiolib, notifier_call_chain, or bitmap_free

Monitoring Recommendations

Track processes opening /dev/gpiochip* and correlate with unexpected exits or crashes
Alert on kernel panics and oops events forwarded to centralized logging on embedded and IoT fleets
Inventory kernel versions across Linux workloads and flag hosts running vulnerable 6.9-rc or unpatched stable branches

How to Mitigate CVE-2024-36899

Immediate Actions Required

Apply the upstream fix by upgrading to a Linux kernel that includes commits 02f6b0e1ec7e, 95ca7c90eaf5, or ca710b5f40b8
Apply distribution updates from Debian LTS (see Debian LTS Announcement March 2025 - 1 and Debian LTS Announcement March 2025 - 2)
For Siemens industrial products, follow guidance in Siemens Security Advisory SSA-265688

Patch Information

The fix reorders the cleanup in gpio_chrdev_release() so that bitmap_free(cdev->watched_lines) is called only after blocking_notifier_chain_unregister() completes. This ensures no in-flight notifier callback can access the freed bitmap. Patches are available in the mainline and stable trees via the kernel.org commits linked above.

Workarounds

Restrict access to /dev/gpiochip* device nodes using strict Unix permissions and udev rules so only trusted service accounts can open them
Disable or unload GPIO drivers that are not required on production systems, particularly on embedded and industrial gateways
Where kernel upgrades are infeasible, isolate affected workloads on hardware that does not expose GPIO character devices to unprivileged users

bash

# Verify kernel version and check for the fix
uname -r

# Restrict GPIO chrdev access via udev (example)
# /etc/udev/rules.d/60-gpio-restrict.rules
KERNEL=="gpiochip*", GROUP="gpio", MODE="0660"

# Reload udev rules
sudo udevadm control --reload-rules && sudo udevadm trigger