CVE-2024-36972: Linux Kernel Race Condition Vulnerability

CVE-2024-36972 Overview

CVE-2024-36972 is a race condition in the Linux kernel's af_unix subsystem that leads to a NULL pointer dereference [CWE-476]. The flaw exists between __unix_gc() and queue_oob() when handling out-of-band (OOB) messages on AF_UNIX sockets. The garbage collector can set unix_sk(sk)->oob_skb to NULL locklessly while a peer socket concurrently updates the same pointer via queue_oob(). The result is a kernel NULL pointer dereference that causes a system crash, and under specific conditions may be leveraged for further impact on local Linux systems.

Critical Impact
A successful exploit triggers a kernel oops in skb_dequeue via unix_release_sock, leading to denial of service and potential memory corruption affecting confidentiality, integrity, and availability.

Affected Products

Linux Kernel (multiple stable branches prior to fix commits)
Distributions shipping vulnerable kernels using CONFIG_UNIX with MSG_OOB handling
Systems exposing AF_UNIX sockets to local untrusted processes

Discovery Timeline

Vulnerability reported by Billy Jheng Bing-Jhong (as credited in the kernel commit message)
2024-06-10 - CVE-2024-36972 published to NVD
2025-04-01 - Last updated in NVD database

Technical Details for CVE-2024-36972

Vulnerability Analysis

The vulnerability resides in the af_unix socket implementation in net/unix/af_unix.c. The Linux kernel garbage collector function __unix_gc() reclaims closed inflight AF_UNIX sockets. When a socket carries an out-of-band message in unix_sk(sk)->oob_skb, the collector drops the reference and sets the field to NULL without holding a lock.

Concurrently, a peer socket can call queue_oob() to send a new MSG_OOB message. That path updates the same oob_skb pointer. With no synchronization between the two writers, the pointer state becomes inconsistent. Subsequent dequeue operations in skb_dequeue then dereference a NULL next/prev link, producing the kernel oops shown in the report at address 0x8.

The fix serializes all reads and writes of unix_sk(sk)->oob_skb under the sk_receive_queue lock. The patch also defers kfree_skb() in manage_oob() to avoid lockdep false positives. The bug requires a network-reachable AF_UNIX peer and local privileges to operate the sockets, which is reflected in the attack complexity.

Root Cause

The root cause is a missing lock acquisition around updates to the oob_skb field of struct unix_sock. The garbage collector path and the OOB enqueue path both mutate the field without a common synchronization primitive, producing a classic data race that culminates in a NULL pointer dereference.

Attack Vector

Exploitation requires a local attacker that can create AF_UNIX socket pairs and exchange MSG_OOB messages while triggering socket close operations that invoke the garbage collector. By racing close() of an inflight socket against send(MSG_OOB) on the peer, the attacker forces the kernel into the racing window. Verified exploit code is not publicly listed for this CVE, and EPSS data indicates low observed exploitation activity.

The panic trace shows the failing instruction inside skb_dequeue, reached from unix_release_sock during delayed_fput workqueue processing, confirming the close-time window as the trigger point.

Detection Methods for CVE-2024-36972

Indicators of Compromise

Kernel oops messages referencing skb_dequeue, unix_release_sock, or unix_release in dmesg and /var/log/kern.log
Crash signature BUG: kernel NULL pointer dereference, address: 0000000000000008 originating from the delayed_fput workqueue
Unexpected reboots or kernel panics on hosts running unpatched Linux kernels with active AF_UNIX MSG_OOB traffic

Detection Strategies

Inventory running kernel versions across the fleet and compare against the fix commits 4708f49a, 4bf69644, 518a994a, 9841991a, and d59ae931 in the stable tree
Monitor audit logs for processes invoking sendmsg with MSG_OOB on AF_UNIX sockets, which is uncommon in normal workloads
Correlate kernel crash telemetry with process activity to identify suspicious local users exercising the race

Monitoring Recommendations

Forward kernel ring buffer and kdump artifacts to a centralized log platform for crash signature analysis
Alert on repeated unix_release_sock oops events from the same host or user session
Track package manager events for kernel updates to verify patch deployment status

How to Mitigate CVE-2024-36972

Immediate Actions Required

Upgrade to a Linux kernel version that includes the upstream fix series for af_unix OOB skb locking
Apply distribution security updates from your Linux vendor that backport the fix commits to supported kernels
Restrict local user access on multi-tenant hosts until patched kernels are deployed

Patch Information

The upstream fix is distributed across the stable kernel tree as a series of commits. Refer to the kernel.org references for the exact patches: Kernel commit 4708f49a, Kernel commit 4bf69644, Kernel commit 518a994a, Kernel commit 9841991a, and Kernel commit d59ae931. The patches move every read and write of unix_sk(sk)->oob_skb under the sk_receive_queue spinlock.

Workarounds

Limit creation of AF_UNIX sockets by untrusted users via seccomp or namespace isolation where feasible
Avoid applications that rely on MSG_OOB over AF_UNIX on unpatched hosts
Apply kernel live-patching from your distribution vendor if reboot windows are constrained

bash

# Verify kernel version and confirm patch presence after update
uname -r
# Example: check for fix commits in a built kernel source tree
git -C /usr/src/linux log --oneline | grep -E "4708f49a|4bf69644|518a994a|9841991a|d59ae931"