CVE-2024-36904: Linux Kernel Use-After-Free Vulnerability

CVE-2024-36904 Overview

CVE-2024-36904 is a use-after-free vulnerability [CWE-416] in the Linux kernel's TCP subsystem, specifically in the tcp_twsk_unique() function. The flaw stems from a race condition introduced by commit ec94c2696f0b ("tcp/dccp: avoid one atomic operation for timewait hashdance"), which deferred setting a TIME-WAIT socket's sk_refcnt until after the socket was placed in the established hash and the bucket lock was released.

During this small window, concurrent threads attempting to reuse the port during connect() can call sock_hold() on a TIME-WAIT socket whose reference count is still zero. The resulting refcount underflow triggers a use-after-free condition that can corrupt kernel memory.

Critical Impact
Local attackers can trigger memory corruption in the Linux kernel TCP stack, leading to denial of service or potential privilege escalation on affected systems.

Affected Products

Linux Kernel (multiple stable branches prior to the fix)
Linux Kernel 6.9-rc1 through 6.9-rc7
Debian Linux 10.0

Discovery Timeline

Vulnerability reported by Anderson Nascimento with reproducer and analysis
2024-05-30 - CVE-2024-36904 published to NVD
2026-05-12 - Last updated in NVD database

Technical Details for CVE-2024-36904

Vulnerability Analysis

The vulnerability resides in the TCP TIME-WAIT socket handling path. When a TCP connection enters the TIME-WAIT state, inet_twsk_hashdance() inserts the socket into the established hash table (ehash). Following the optimization in commit ec94c2696f0b, the function sets sk_refcnt only after inserting the socket and releasing the bucket lock.

This creates a narrow race window. Another CPU performing a connect() syscall can traverse the same hash chain, locate the TIME-WAIT socket, and invoke tcp_twsk_unique() to check whether the 4-tuple can be reused. Inside tcp_twsk_unique(), the code calls sock_hold(), which performs an unconditional refcount_inc() on a refcount that is still zero.

The kernel's refcount_t infrastructure detects this as addition on 0; use-after-free and emits a warning, but the corrupted refcount then causes sock_put() to underflow and free the socket while it remains in use elsewhere. The crash signature in refcount_warn_saturate+0xe5/0x110 called from tcp_twsk_unique+0x186/0x190 confirms the path.

Root Cause

The root cause is an ordering issue between hash table insertion and reference count initialization. The hashdance optimization made the socket visible to lookups before its refcount became non-zero, violating the invariant assumed by sock_hold().

Attack Vector

Exploitation requires local access and the ability to issue rapid connect() calls against ports recently used by TIME-WAIT sockets. A local user can race port reuse during outbound connections to trigger the underflow. The vulnerability is reachable from unprivileged user space and does not require special capabilities.

The upstream fix replaces the unconditional sock_hold() inside tcp_twsk_unique() with refcount_inc_not_zero(). If the refcount is zero, the caller abandons port reuse and continues searching, eliminating the race. See the upstream commit 1d9cf07 for the canonical patch.

Detection Methods for CVE-2024-36904

Indicators of Compromise

Kernel log entries containing refcount_t: addition on 0; use-after-free originating from tcp_twsk_unique
WARNING stack traces in refcount_warn_saturate with call paths through __inet_check_established, __inet_hash_connect, and tcp_v4_connect
Unexpected kernel panics or oopses on hosts under heavy outbound TCP connection churn

Detection Strategies

Monitor /var/log/kern.log, dmesg, and journald for refcount saturation warnings tied to TCP code paths.
Correlate kernel warnings with processes generating high rates of short-lived outbound TCP connections.
Inventory Linux hosts and compare running kernel versions against the fixed stable releases listed in the kernel.org commits.

Monitoring Recommendations

Forward kernel ring buffer events to a centralized logging or SIEM platform for refcount and use-after-free pattern matching.
Alert on repeated refcount_warn_saturate events from any host, as these often precede memory corruption.
Track unprivileged processes performing abnormal volumes of connect() syscalls to recently closed ports.

How to Mitigate CVE-2024-36904

Immediate Actions Required

Update affected Linux systems to a stable kernel release that includes the refcount_inc_not_zero() fix in tcp_twsk_unique().
Apply Debian LTS kernel updates published in the Debian LTS Announcement #19 and Debian LTS Announcement #20.
Review vendor-specific advisories such as the NetApp Security Advisory NTAP-20240905-0004 and Siemens advisories (SSA-265688, SSA-398330, SSA-613116) for affected appliances.

Patch Information

The fix is distributed across multiple stable branches via the upstream commits 13ed7df, 1796ca9, 1d9cf07, 27b0284, 517e32e, 6e48faa, 84546cc, and f2db723. Distribution maintainers have backported the fix to supported long-term kernels.

Workarounds

No reliable runtime workaround exists short of patching, since the race is inherent to the TIME-WAIT hashdance code path.
Restrict local shell access on multi-tenant systems to reduce the population of users able to trigger rapid port-reuse races.
Monitor kernel warnings closely and schedule expedited reboots after applying kernel updates, since live patching support varies by distribution.

bash

# Verify the running kernel against the distribution's fixed version
uname -r

# Debian/Ubuntu: install the patched kernel package and reboot
sudo apt-get update && sudo apt-get install --only-upgrade linux-image-$(uname -r | sed 's/-[^-]*$//')
sudo reboot

# RHEL/CentOS/Fedora: update the kernel and reboot
sudo dnf update kernel
sudo reboot