{
  "schema_version": "1.6.1",
  "id": "RPI-CVE-2024-41010",
  "modified": "2026-10-09T11:39:44Z",
  "upstream": [
    "CVE-2024-41010"
  ],
  "published": "2024-07-17T06:10:49Z",
  "summary": "bpf: Fix too early release of tcx_entry",
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix too early release of tcx_entry\n\nPedro Pinto and later independently also Hyunwoo Kim and Wongi Lee reported\nan issue that the tcx_entry can be released too early leading to a use\nafter free (UAF) when an active old-style ingress or clsact qdisc with a\nshared tc block is later replaced by another ingress or clsact instance.\n\nEssentially, the sequence to trigger the UAF (one example) can be as follows:\n\n  1. A network namespace is created\n  2. An ingress qdisc is created. This allocates a tcx_entry, and\n     &tcx_entry->miniq is stored in the qdisc's miniqp->p_miniq. At the\n     same time, a tcf block with index 1 is created.\n  3. chain0 is attached to the tcf block. chain0 must be connected to\n     the block linked to the ingress qdisc to later reach the function\n     tcf_chain0_head_change_cb_del() which triggers the UAF.\n  4. Create and graft a clsact qdisc. This causes the ingress qdisc\n     created in step 1 to be removed, thus freeing the previously linked\n     tcx_entry:\n\n     rtnetlink_rcv_msg()\n       => tc_modify_qdisc()\n         => qdisc_create()\n           => clsact_init() [a]\n         => qdisc_graft()\n           => qdisc_destroy()\n             => __qdisc_destroy()\n               => ingress_destroy() [b]\n                 => tcx_entry_free()\n                   => kfree_rcu() // tcx_entry freed\n\n  5. Finally, the network namespace is closed. This registers the\n     cleanup_net worker, and during the process of releasing the\n     remaining clsact qdisc, it accesses the tcx_entry that was\n     already freed in step 4, causing the UAF to occur:\n\n     cleanup_net()\n       => ops_exit_list()\n         => default_device_exit_batch()\n           => unregister_netdevice_many()\n             => unregister_netdevice_many_notify()\n               => dev_shutdown()\n                 => qdisc_put()\n                   => clsact_destroy() [c]\n                     => tcf_block_put_ext()\n                       => tcf_chain0_head_change_cb_del()\n                         => tcf_chain_head_change_item()\n                           => clsact_chain_head_change()\n                             => mini_qdisc_pair_swap() // UAF\n\nThere are also other variants, the gist is to add an ingress (or clsact)\nqdisc with a specific shared block, then to replace that qdisc, waiting\nfor the tcx_entry kfree_rcu() to be executed and subsequently accessing\nthe current active qdisc's miniq one way or another.\n\nThe correct fix is to turn the miniq_active boolean into a counter. What\ncan be observed, at step 2 above, the counter transitions from 0->1, at\nstep [a] from 1->2 (in order for the miniq object to remain active during\nthe replacement), then in [b] from 2->1 and finally [c] 1->0 with the\neventual release. The reference counter in general ranges from [0,2] and\nit does not need to be atomic since all access to the counter is protected\nby the rtnl mutex. With this in place, there is no longer a UAF happening\nand the tcx_entry is freed at the correct time.",
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
    }
  ],
  "affected": [
    {
      "package": {
        "ecosystem": "Raspberry Pi OS:12",
        "name": "linux"
      },
      "versions": [
        "1:6.6.20-1+rpt1",
        "1:6.6.28-1+rpt1",
        "1:6.6.31-1+rpt1"
      ],
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "linux-image-6.6.20+rpt-rpi-2712",
            "binary_version": "1:6.6.20-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.6.20+rpt-rpi-v6",
            "binary_version": "1:6.6.20-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.6.20+rpt-rpi-v7",
            "binary_version": "1:6.6.20-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.6.20+rpt-rpi-v7l",
            "binary_version": "1:6.6.20-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.6.20+rpt-rpi-v8",
            "binary_version": "1:6.6.20-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.6.28+rpt-rpi-2712",
            "binary_version": "1:6.6.28-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.6.28+rpt-rpi-v6",
            "binary_version": "1:6.6.28-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.6.28+rpt-rpi-v7",
            "binary_version": "1:6.6.28-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.6.28+rpt-rpi-v7l",
            "binary_version": "1:6.6.28-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.6.28+rpt-rpi-v8",
            "binary_version": "1:6.6.28-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.6.31+rpt-rpi-2712",
            "binary_version": "1:6.6.31-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.6.31+rpt-rpi-v6",
            "binary_version": "1:6.6.31-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.6.31+rpt-rpi-v7",
            "binary_version": "1:6.6.31-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.6.31+rpt-rpi-v7l",
            "binary_version": "1:6.6.31-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.6.31+rpt-rpi-v8",
            "binary_version": "1:6.6.31-1+rpt1"
          }
        ]
      },
      "database_specific": {
        "per_version": {
          "1:6.6.20-1+rpt1": {
            "linux_commit": "6f16847710cc0502450788b9f12f0a14d3429668",
            "upstream_version": "6.6.20",
            "assessment": "commit ancestry (strak rule)",
            "upstream_fixed": "6.6.41"
          },
          "1:6.6.28-1+rpt1": {
            "linux_commit": "0c341f47adc3578cd5f817aa20ee2b7f9ae6b23e",
            "upstream_version": "6.6.28",
            "assessment": "commit ancestry (strak rule)",
            "upstream_fixed": "6.6.41"
          },
          "1:6.6.31-1+rpt1": {
            "linux_commit": "c1432b4bae5b6582f4d32ba381459f33c34d1424",
            "upstream_version": "6.6.31",
            "assessment": "commit ancestry (strak rule)",
            "upstream_fixed": "6.6.41"
          }
        }
      }
    }
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-41010"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/230bb13650b0f186f540500fd5f5f7096a822a2a"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/f61ecf1bd5b562ebfd7d430ccb31619857e80857"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/1cb6f0bae50441f4b4b32a28315853b279c7404e"
    }
  ],
  "database_specific": {
    "source": "https://git.kernel.org/pub/scm/linux/security/vulns.git",
    "upstream_modified": "2026-08-05T11:52:36Z",
    "severity": {
      "source": "kernel CNA",
      "cvss_v3_score": 7.8,
      "cvss_v3_severity": "High",
      "scenario": "AV:L - The vulnerability is reached through rtnetlink `RTM_NEWQDISC`/`RTM_NEWTFILTER` messages (`tc_modify_qdisc()` \u2192 `ingress_init`/`clsact_init`/`*_destroy`) and network-namespace teardown, all of which require local access via a netlink socket and syscalls. No remote packet can drive the qdisc configuration path.\nAC:L - The attacker deterministically controls every step \u2014 create netns, create ingress qdisc with a shared block, attach chain0, graft a clsact qdisc to free the tcx_entry, then close the netns \u2014 with all mutations serialized under the rtnl mutex, so there is no race to win, only an RCU grace period to wait out. Heap grooming of the kmalloc-2048 slot is entirely under attacker control.\nPR:L - `rtnetlink_rcv_msg()` gates qdisc creation on `netlink_net_capable(skb, CAP_NET_ADMIN)` evaluated against the netns owner's user namespace, so an unprivileged local user obtains it with `unshare -Urn` \u2014 the published trigger sequence itself begins by creating a network namespace. No real root or init-namespace privilege is needed.\nUI:N - The entire sequence is performed by the attacker's own process; the final UAF fires from the `cleanup_net` worker triggered by the attacker closing its own network namespace. No victim action of any kind is involved.\nS:U - The corruption occurs in kernel heap memory and the impact stays within the same kernel security authority (local privilege escalation). No hypervisor, IOMMU, or other security-authority boundary is crossed.\nC:H - This is a use-after-free with an attacker-timed read of the freed `tcx_entry->miniq` slot, and the reclaimed ~1.6 KB kmalloc-2048 object can be sprayed with attacker-chosen structures, giving a path to disclose kernel heap pointers and read arbitrary kernel memory via a corrupted `mini_Qdisc`/`filter_list` chain.\nI:H - `mini_qdisc_pair_swap()` writes a kernel pointer (or NULL) into offset 0 of the freed object, corrupting whatever object was reallocated there, and the write can be repeated on demand by adding/removing filters on the shared block. Combined with the RX path's indirect call through `miniq->filter_list` in `tcf_classify()`, this yields a control-flow hijack primitive suitable for full privilege escalation.\nA:H - Even without successful exploitation, the use-after-free write into freed slab memory reliably corrupts unrelated kernel objects and panics the machine (KASAN-detected UAF, oops in `mini_qdisc_pair_swap`/`cleanup_net`). It can be triggered repeatedly by any unprivileged local user."
    }
  }
}