{
  "schema_version": "1.6.1",
  "id": "RPI-CVE-2024-41040",
  "modified": "2026-10-09T11:39:44Z",
  "upstream": [
    "CVE-2024-41040"
  ],
  "published": "2024-07-29T14:32:49Z",
  "summary": "net/sched: Fix UAF when resolving a clash",
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: Fix UAF when resolving a clash\n\nKASAN reports the following UAF:\n\n BUG: KASAN: slab-use-after-free in tcf_ct_flow_table_process_conn+0x12b/0x380 [act_ct]\n Read of size 1 at addr ffff888c07603600 by task handler130/6469\n\n Call Trace:\n  <IRQ>\n  dump_stack_lvl+0x48/0x70\n  print_address_description.constprop.0+0x33/0x3d0\n  print_report+0xc0/0x2b0\n  kasan_report+0xd0/0x120\n  __asan_load1+0x6c/0x80\n  tcf_ct_flow_table_process_conn+0x12b/0x380 [act_ct]\n  tcf_ct_act+0x886/0x1350 [act_ct]\n  tcf_action_exec+0xf8/0x1f0\n  fl_classify+0x355/0x360 [cls_flower]\n  __tcf_classify+0x1fd/0x330\n  tcf_classify+0x21c/0x3c0\n  sch_handle_ingress.constprop.0+0x2c5/0x500\n  __netif_receive_skb_core.constprop.0+0xb25/0x1510\n  __netif_receive_skb_list_core+0x220/0x4c0\n  netif_receive_skb_list_internal+0x446/0x620\n  napi_complete_done+0x157/0x3d0\n  gro_cell_poll+0xcf/0x100\n  __napi_poll+0x65/0x310\n  net_rx_action+0x30c/0x5c0\n  __do_softirq+0x14f/0x491\n  __irq_exit_rcu+0x82/0xc0\n  irq_exit_rcu+0xe/0x20\n  common_interrupt+0xa1/0xb0\n  </IRQ>\n  <TASK>\n  asm_common_interrupt+0x27/0x40\n\n Allocated by task 6469:\n  kasan_save_stack+0x38/0x70\n  kasan_set_track+0x25/0x40\n  kasan_save_alloc_info+0x1e/0x40\n  __kasan_krealloc+0x133/0x190\n  krealloc+0xaa/0x130\n  nf_ct_ext_add+0xed/0x230 [nf_conntrack]\n  tcf_ct_act+0x1095/0x1350 [act_ct]\n  tcf_action_exec+0xf8/0x1f0\n  fl_classify+0x355/0x360 [cls_flower]\n  __tcf_classify+0x1fd/0x330\n  tcf_classify+0x21c/0x3c0\n  sch_handle_ingress.constprop.0+0x2c5/0x500\n  __netif_receive_skb_core.constprop.0+0xb25/0x1510\n  __netif_receive_skb_list_core+0x220/0x4c0\n  netif_receive_skb_list_internal+0x446/0x620\n  napi_complete_done+0x157/0x3d0\n  gro_cell_poll+0xcf/0x100\n  __napi_poll+0x65/0x310\n  net_rx_action+0x30c/0x5c0\n  __do_softirq+0x14f/0x491\n\n Freed by task 6469:\n  kasan_save_stack+0x38/0x70\n  kasan_set_track+0x25/0x40\n  kasan_save_free_info+0x2b/0x60\n  ____kasan_slab_free+0x180/0x1f0\n  __kasan_slab_free+0x12/0x30\n  slab_free_freelist_hook+0xd2/0x1a0\n  __kmem_cache_free+0x1a2/0x2f0\n  kfree+0x78/0x120\n  nf_conntrack_free+0x74/0x130 [nf_conntrack]\n  nf_ct_destroy+0xb2/0x140 [nf_conntrack]\n  __nf_ct_resolve_clash+0x529/0x5d0 [nf_conntrack]\n  nf_ct_resolve_clash+0xf6/0x490 [nf_conntrack]\n  __nf_conntrack_confirm+0x2c6/0x770 [nf_conntrack]\n  tcf_ct_act+0x12ad/0x1350 [act_ct]\n  tcf_action_exec+0xf8/0x1f0\n  fl_classify+0x355/0x360 [cls_flower]\n  __tcf_classify+0x1fd/0x330\n  tcf_classify+0x21c/0x3c0\n  sch_handle_ingress.constprop.0+0x2c5/0x500\n  __netif_receive_skb_core.constprop.0+0xb25/0x1510\n  __netif_receive_skb_list_core+0x220/0x4c0\n  netif_receive_skb_list_internal+0x446/0x620\n  napi_complete_done+0x157/0x3d0\n  gro_cell_poll+0xcf/0x100\n  __napi_poll+0x65/0x310\n  net_rx_action+0x30c/0x5c0\n  __do_softirq+0x14f/0x491\n\nThe ct may be dropped if a clash has been resolved but is still passed to\nthe tcf_ct_flow_table_process_conn function for further usage. This issue\ncan be fixed by retrieving ct from skb again after confirming conntrack.",
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
    }
  ],
  "affected": [
    {
      "package": {
        "ecosystem": "Raspberry Pi OS:12",
        "name": "linux"
      },
      "versions": [
        "1:6.1.47-1+rpt4"
      ],
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-2712",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v6",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v7",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v7l",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v8",
            "binary_version": "1:6.1.47-1+rpt4"
          }
        ]
      },
      "database_specific": {
        "per_version": {
          "1:6.1.47-1+rpt4": {
            "linux_commit": "655fc658a15ae7a6f37103754adb39ba52a9a14e",
            "upstream_version": "6.1.47",
            "assessment": "commit ancestry (strak rule)",
            "upstream_fixed": "6.1.100",
            "compiled_filter": false
          }
        }
      }
    }
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-41040"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/b81a523d54ea689414f67c9fb81a5b917a41ed55"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/2b4d68df3f57ea746c430941ba9c03d7d8b5a23f"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/4e71b10a100861fb27d9c5755dfd68f615629fae"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/799a34901b634008db4a7ece3900e2b971d4c932"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/ef472cc6693b16b202a916482df72f35d94bd69e"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/26488172b0292bed837b95a006a3f3431d1898c3"
    }
  ],
  "database_specific": {
    "source": "https://git.kernel.org/pub/scm/linux/security/vulns.git",
    "upstream_modified": "2026-08-05T11:52:36Z",
    "severity": {
      "source": "kernel CNA",
      "cvss_v3_score": 9.8,
      "cvss_v3_severity": "Critical",
      "scenario": "AV:N - The vulnerable code executes in the NAPI receive softirq (`sch_handle_ingress` \u2192 `tcf_classify` \u2192 `tcf_ct_act`) on data taken directly from arriving packets, as the KASAN `<IRQ>`/`net_rx_action` trace shows. On any host configured with `action ct commit` (OVS-TC/OVN/Kubernetes offload nodes, the subsystem's primary deployment), an off-host attacker triggers it purely by sending routable UDP/ICMP/GRE traffic to or through the node.\nAC:L - The attacker controls both sides of the race by flooding packets with an identical 5-tuple, which RSS spreads across CPUs so two unconfirmed conntracks reach `nf_conntrack_confirm` concurrently \u2014 conntrack clashes on UDP bursts are so routine that the kernel has dedicated clash-resolution machinery and counters for them. Once a clash occurs the free of the loser ct and the subsequent stale dereference are deterministic.\nPR:N - Conntrack processing happens on ingress before any application-layer authentication or socket delivery, so the attacker needs no account, credentials, or local access on the target. The tc/act_ct configuration is established by the administrator as part of normal deployment, not by the attacker.\nUI:N - The UAF is triggered entirely by unsolicited inbound packets processed in softirq context; no local user or administrator has to open, mount, or interact with anything.\nS:U - The freed conntrack object, the corrupting writes, and the impacted flow-offload table all live within the same host kernel's security authority. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - The freed `nf_ct_ext` is a plain kmalloc object that an attacker can reclaim and spray, and `nf_conn_act_ct_ext_find()` uses an attacker-controlled `u8` offset from it as a pointer offset, yielding a controlled out-of-bounds read whose result is written into the offload tuple. The dangling `nf_conn` is also read wholesale into the flow entry, exposing reclaimed kernel memory.\nI:H - `tcf_ct_flow_table_add()` writes into the freed object \u2014 `test_and_set_bit(IPS_OFFLOAD_BIT, &ct->status)`, `refcount_inc(&ct->ct_general.use)`, and `ct->proto.tcp.seen[].flags |=` \u2014 and persists `flow->ct` as a dangling pointer in the flow-offload table. With the `nf_conn` slab (SLAB_TYPESAFE_BY_RCU) reclaimed by attacker-sprayed connections, this produces refcount confusion and later double-free/UAF on a live object, a classic path to control-flow hijack.\nA:H - The use-after-free reliably crashes the kernel in softirq context under KASAN or slab poisoning, and unpoisoned it corrupts conntrack refcounting and the flow-offload table, leading to oops or panic. The attacker can repeat the packet flood indefinitely to keep re-triggering it."
    }
  }
}