CVE-2024-36939: Linux Kernel Privilege Escalation Flaw

CVE-2024-36939 Overview

CVE-2024-36939 is a Linux kernel vulnerability in the Network File System (NFS) subsystem. The flaw resides in nfs_net_init(), which fails to handle errors returned by rpc_proc_register(). When the procfs registration fails, nfs_net_init() still returns success. The subsequent nfs_net_exit() call during network namespace teardown invokes remove_proc_entry() on a nonexistent proc directory, triggering a kernel warning and a denial of service condition.

The issue dates back to the initial kernel commit 1da177e4c3f4 ("Linux-2.6.12-rc2") and became more visible after commit d47151b79e32 exposed /proc/net/sunrpc/nfs per network namespace. The bug was discovered by syzkaller fuzzing.

Critical Impact
A local unprivileged user with the capability to create new network namespaces can trigger a kernel warning and availability impact during namespace destruction.

Affected Products

Linux Kernel versions from 2.6.12-rc2 through 6.9-rc6 (prior to patched commits)
Debian Linux 10.0
Siemens products referenced in advisory SSA-265688

Discovery Timeline

2024-05-30 - CVE-2024-36939 published to NVD
2026-05-12 - Last updated in NVD database

Technical Details for CVE-2024-36939

Vulnerability Analysis

The vulnerability is a kernel-level error handling flaw in the NFS network namespace initialization path. When a process unshares its network namespace using the unshare() system call, the kernel invokes nfs_net_init() to set up per-namespace NFS state. This function calls rpc_proc_register() to register an entry under /proc/net/sunrpc/nfs. The original code ignored the return value of rpc_proc_register(), allowing initialization to proceed as successful even when proc registration failed.

During namespace teardown, nfs_net_exit() calls rpc_proc_unregister(), which in turn calls remove_proc_entry(). Because the corresponding proc entry was never created, the function operates on a missing directory and triggers a WARN at fs/proc/generic.c:711. The syzkaller-reported call trace shows the warning originating from remove_proc_entry+0x1bb/0x2d0, reachable via copy_net_ns() and ksys_unshare().

Root Cause

The root cause is missing error propagation in nfs_net_init() at fs/nfs/inode.c. The function did not check the return value of rpc_proc_register() and unconditionally returned zero. This created an inconsistent state between initialization and the matching exit routine, which assumed the proc entry existed.

Attack Vector

The attack vector is local. An unprivileged user that holds CAP_SYS_ADMIN within a user namespace, or any local process able to call unshare(CLONE_NEWNET), can attempt to create immature network namespaces under resource pressure. When rpc_proc_register() fails (for example due to memory constraints), the warning fires and the kernel logs are polluted. Systems configured with panic_on_warn will panic, producing a denial of service. The vulnerability does not affect confidentiality or integrity.

No verified public proof-of-concept code is available. The original reproducer is the syzkaller fuzzer reaching the unshare syscall path described in the kernel commit message. See the Linux Kernel Commit 9909dde2 for the upstream patch.

Detection Methods for CVE-2024-36939

Indicators of Compromise

Kernel warning messages referencing remove_proc_entry+0x1bb/0x2d0 at fs/proc/generic.c:711 in dmesg or /var/log/kern.log
Warning text containing name 'nfs' immediately preceding the remove_proc_entry trace
Call traces including rpc_proc_unregister, nfs_net_exit, ops_exit_list, and copy_net_ns
Unexpected kernel panics on systems with kernel.panic_on_warn=1 correlated with unshare() syscalls

Detection Strategies

Audit kernel logs for WARNING: CPU: ... at fs/proc/generic.c entries tied to NFS proc paths
Use auditd rules to track unshare() and clone() syscalls invoking CLONE_NEWNET from unprivileged users
Inspect installed kernel versions against the fixed commits listed in the kernel.org stable tree
Cross-reference distro advisories such as the Debian LTS Announcement

Monitoring Recommendations

Centralize kernel logs and alert on repeated NFS-related WARN events from the same host or user
Monitor for processes performing high-frequency network namespace creation, which is uncommon outside container runtimes
Track kernel package versions across the fleet and flag hosts still running unpatched 5.x or 6.x kernels

How to Mitigate CVE-2024-36939

Immediate Actions Required

Apply the vendor-supplied kernel update from your Linux distribution as soon as it is available
For Debian 10 systems, install the kernel update referenced in the Debian LTS Announcement
For Siemens industrial products, follow remediation steps in Siemens Security Advisory SSA-265688
Disable kernel.panic_on_warn on production hosts where the warning alone would otherwise cause downtime

Patch Information

The upstream fix adds proper error handling for rpc_proc_register() in nfs_net_init(). The patch is available in multiple stable branches via the following commits: 24457f1, 8a1f89c, 8ae63bd, 9909dde, b33ca18, d4891d8, and ea6ce93.

Workarounds

Restrict unprivileged user namespace creation by setting kernel.unprivileged_userns_clone=0 where supported, which blocks the typical local trigger path
Limit access to unshare(CLONE_NEWNET) through seccomp profiles for untrusted workloads and containers
Apply memory and resource quotas to prevent low-memory conditions that increase the likelihood of rpc_proc_register() failing

bash

# Configuration example
# Restrict unprivileged user namespace creation (Debian/Ubuntu)
sysctl -w kernel.unprivileged_userns_clone=0
echo 'kernel.unprivileged_userns_clone=0' >> /etc/sysctl.d/99-cve-2024-36939.conf

# Prevent system panic on kernel warnings
sysctl -w kernel.panic_on_warn=0

# Verify installed kernel version against the patched release
uname -r