CVE-2024-46858: Linux Kernel Race Condition Vulnerability

CVE-2024-46858 Overview

CVE-2024-46858 is a use-after-free (UAF) vulnerability in the Linux kernel's Multipath TCP (MPTCP) path manager subsystem. The flaw exists in mptcp_pm_del_add_timer where a race condition between the network receive path and a netlink-driven address removal allows kernel memory to be freed while still referenced. An attacker with local access who can trigger MPTCP path manager operations may corrupt kernel memory. The issue is tracked as CWE-416 and was fixed in the upstream Linux kernel.

Critical Impact
Successful exploitation of the race condition in mptcp_pm_del_add_timer can lead to kernel memory corruption, potentially enabling privilege escalation or kernel denial of service on hosts using MPTCP.

Affected Products

Linux Kernel 6.11 release candidates (rc1 through rc7)
Earlier Linux kernel branches containing the MPTCP path manager add_addr timer logic
Debian distributions tracked by the January and March 2025 Debian LTS announcements

Discovery Timeline

2024-09-27 - CVE-2024-46858 published to the National Vulnerability Database
2025-12-24 - Last updated in the NVD database

Technical Details for CVE-2024-46858

Vulnerability Analysis

The vulnerability resides in the MPTCP path manager (net/mptcp/pm_netlink.c). Two execution paths can reach mptcp_pm_del_add_timer concurrently. CPU1 enters from the network receive softirq through tcp_v4_rcv → mptcp_incoming_options → mptcp_pm_del_add_timer. CPU2 enters from userspace via a generic netlink call mptcp_pm_nl_flush_addrs_doit → mptcp_nl_remove_addrs_list → remove_anno_list_by_saddr.

On CPU2, once the code exits the critical section protected by pm.lock, the entry structure is freed with kfree(entry). If CPU1 is concurrently executing inside mptcp_pm_del_add_timer and dereferences entry->add_timer after the free, the kernel operates on dangling memory. The result is a use-after-free in __timer_delete_sync.

The upstream fix keeps a local reference to add_timer while still holding pm.lock, then calls sk_stop_timer_sync() against that saved reference rather than entry->add_timer. The patch also moves list_del(&entry->list) into mptcp_pm_del_add_timer under the lock, removing all access to entry members outside the protected region.

Root Cause

The root cause is improper synchronization between the receive-path timer cleanup and the netlink-driven address removal. The lifetime of the mptcp_pm_add_entry object is not guaranteed across the lock boundary, allowing one thread to free the object while another still holds a pointer derived from it.

Attack Vector

The attack vector is local. An authenticated attacker who can issue MPTCP path manager netlink commands such as MPTCP_PM_CMD_FLUSH_ADDRS while MPTCP traffic is being processed may trigger the race. Reliable exploitation requires precise scheduling, reflected in the high attack complexity. Successful exploitation can yield kernel memory corruption.

No public proof-of-concept exploit is associated with this CVE, and it is not listed in the CISA Known Exploited Vulnerabilities catalog. Technical details for the fix are documented in the upstream commits referenced below — see Kernel Git Commit b4cd80b and Kernel Git Commit 67409b.

Detection Methods for CVE-2024-46858

Indicators of Compromise

Kernel oops or panic messages referencing __timer_delete_sync, mptcp_pm_del_add_timer, or remove_anno_list_by_saddr in dmesg and /var/log/kern.log.
KASAN reports indicating a use-after-free in MPTCP path manager code paths.
Unexpected MPTCP subflow teardowns correlated with bursts of netlink MPTCP_PM_CMD_FLUSH_ADDRS activity.

Detection Strategies

Audit running kernel versions against fixed commits using uname -r and the distribution's security tracker to identify unpatched hosts.
Monitor netlink usage of the MPTCP_PM generic netlink family by unprivileged local processes, which is uncommon on most workloads.
Enable kernel address sanitizer (KASAN) on test fleets to catch UAF conditions before production exposure.

Monitoring Recommendations

Forward kernel logs to a centralized logging or SIEM platform and alert on crash signatures referencing MPTCP symbols.
Track package versions of linux-image-* across the fleet and flag hosts that have not received the January or March 2025 Debian LTS updates.
Baseline normal MPTCP usage and alert on anomalous spikes in path manager netlink commands from non-administrative users.

How to Mitigate CVE-2024-46858

Immediate Actions Required

Apply the latest stable Linux kernel update from your distribution vendor that includes the upstream fix.
On Debian systems, install the kernel updates referenced in the Debian LTS Announcement January 2025 and the Debian LTS Announcement March 2025.
Reboot affected hosts after patching to activate the corrected kernel image.
Restrict local shell access on multi-tenant systems until patches are deployed.

Patch Information

The upstream fix is delivered in the kernel commits 12134a6, 6452b16, 67409b3, and b4cd80b. These commits relocate list_del and the timer reference acquisition inside pm.lock, eliminating the dangling pointer.

Workarounds

Disable MPTCP on hosts that do not require it by setting net.mptcp.enabled=0 via sysctl until a patched kernel can be installed.
Limit CAP_NET_ADMIN to trusted administrators to reduce the population of users who can issue MPTCP path manager netlink commands.
Use seccomp or namespace policies to prevent untrusted workloads from sending generic netlink messages to the MPTCP family.

bash

# Configuration example: disable MPTCP at runtime and persist the change
sudo sysctl -w net.mptcp.enabled=0
echo 'net.mptcp.enabled=0' | sudo tee /etc/sysctl.d/99-disable-mptcp.conf

# Verify current kernel version against fixed releases
uname -r

# Debian: apply kernel security updates
sudo apt-get update && sudo apt-get install --only-upgrade linux-image-$(uname -r | sed 's/.*-//')
sudo reboot