CVE-2024-41006: Linux Kernel Use-After-Free Vulnerability

CVE-2024-41006 Overview

CVE-2024-41006 is a memory leak vulnerability [CWE-401] in the Linux kernel's NET/ROM (netrom) protocol implementation. The flaw resides in the nr_heartbeat_expiry() function, where an unnecessary sock_hold() reference count increment occurs when a socket has the SOCK_DESTROY flag set. Because the file descriptor has already been closed and nr_release() has been called, no subsequent code path releases the held reference, resulting in a leaked socket structure. The issue was reported by syzbot and identified by InfoTeCS on behalf of the Linux Verification Center using Syzkaller fuzzing.

Critical Impact
Local unprivileged users can trigger kernel memory leaks through the NET/ROM amateur radio networking stack, leading to resource exhaustion and potential denial of service on affected Linux systems.

Affected Products

Linux Kernel (multiple stable branches prior to fixed commits)
Linux Kernel 6.10-rc1 through 6.10-rc4
Downstream distributions including Debian LTS and Siemens industrial products

Discovery Timeline

2024-07-12 - CVE-2024-41006 published to NVD
2026-05-12 - Last updated in NVD database

Technical Details for CVE-2024-41006

Vulnerability Analysis

The vulnerability exists in the NET/ROM packet radio protocol implementation within the Linux kernel networking subsystem. A prior fix, commit 409db27e3a2e ("netrom: Fix use-after-free of a listening socket."), introduced a sock_hold() call inside nr_heartbeat_expiry() to address a use-after-free. That patch incremented the socket reference count under two conditions: when the socket carries the SOCK_DESTROY flag, or when a listening socket carries the SOCK_DEAD flag. The SOCK_DESTROY branch is incorrect because, by the time it executes, the user has already closed the file descriptor and nr_release() has run. No further nr_destroy_socket() call is scheduled to release the held reference, so the socket structure leaks on every heartbeat expiry that hits this path.

Root Cause

The root cause is an unbalanced reference count operation. The nr_release() path transitions the socket state to NR_STATE_2 and sets SOCK_DESTROY. Concurrently, an incoming frame processed by nr_state2_machine() invokes nr_disconnect(), which moves the socket to NR_STATE_0 and sets SOCK_DEAD. When the heartbeat timer fires, nr_heartbeat_expiry() observes NR_STATE_0 and SOCK_DESTROY, calls sock_hold() followed by nr_destroy_socket(). The held reference is never released because the closure path has already completed, leaving the sock structure permanently allocated.

Attack Vector

Exploitation requires local access with the ability to create NET/ROM sockets, which typically requires CAP_NET_RAW or that the netrom module is loaded and accessible. An attacker repeatedly opens and closes NET/ROM connections under specific state transitions to trigger the leak. Each triggered path leaks one sock allocation. Sustained abuse depletes kernel memory and degrades system availability. The CVSS vector indicates local attack vector with high availability impact and no confidentiality or integrity impact.

The vulnerability is described in prose only because no public proof-of-concept exploit was released. The fix calls sock_hold() exclusively for the listening-socket case, eliminating the unbalanced reference in the destroy path. Refer to the upstream commits listed in the references for the precise code change.

Detection Methods for CVE-2024-41006

Indicators of Compromise

Growing kmalloc slab usage attributed to socket structures without a corresponding rise in active connections
Repeated creation and teardown of NET/ROM (AF_NETROM) sockets by non-administrative users
Kernel kmemleak reports identifying leaked allocations originating in nr_create() or sk_alloc() from netrom code paths

Detection Strategies

Audit loaded kernel modules for the presence of netrom on systems that do not require amateur radio networking, and treat unexpected loads as suspicious
Monitor /proc/slabinfo for unbounded growth in socket-related caches such as sock_inode_cache and NETROM
Correlate process telemetry showing repeated socket(AF_NETROM, ...) syscalls with rising kernel memory consumption

Monitoring Recommendations

Enable CONFIG_DEBUG_KMEMLEAK on test systems to surface kernel leaks during regression testing
Track kernel version inventory against the upstream fixed commits to identify unpatched hosts
Alert on syslog messages indicating low memory or OOM conditions on hosts where NET/ROM is not a workload requirement

How to Mitigate CVE-2024-41006

Immediate Actions Required

Apply the latest stable Linux kernel update from your distribution vendor that contains the upstream fix
Blacklist the netrom kernel module on systems that do not require amateur packet radio support using /etc/modprobe.d/
Restrict the CAP_NET_RAW capability to administrative users and audit any process that creates AF_NETROM sockets

Patch Information

The fix limits the sock_hold() call in nr_heartbeat_expiry() to the listening-socket case, removing the unbalanced reference acquired when SOCK_DESTROY is set. Patches are available across multiple stable branches via the kernel.org commits referenced in the advisory, including Linux Kernel Commit b6ebe4f and Linux Kernel Commit d377f5a. Distribution-specific updates are tracked in the Debian LTS Announcement and Siemens industrial product advisories such as Siemens SSA-265688.

Workarounds

Disable the netrom module at boot by adding blacklist netrom and install netrom /bin/true directives in modprobe configuration
Remove unused amateur radio networking packages from production servers to eliminate the attack surface entirely
Apply seccomp or AppArmor policies that deny the AF_NETROM address family to untrusted workloads

bash

# Configuration example: blacklist the netrom module
echo "blacklist netrom" | sudo tee /etc/modprobe.d/disable-netrom.conf
echo "install netrom /bin/true" | sudo tee -a /etc/modprobe.d/disable-netrom.conf
sudo update-initramfs -u
# Verify the module is not currently loaded
lsmod | grep netrom