Linux Kernel TCP Race Condition Exposed as Real Use-After-Free

Researchers disclosed CVE-2024-36904, a seven-year-old race condition in the Linux kernel TCP subsystem that can lead to a real use-after-free involving TIME-WAIT sockets. The flaw was introduced by commit ec94c2696f0b, which changed inet_twsk_hashdance() so a socket could be inserted into the established hash table before its reference counter was initialized, allowing concurrent code in paths such as tcp_twsk_unique() and __inet_check_established() to observe a zero refcount and corrupt socket lifetime handling. The issue was first encountered while investigating a syzkaller report that appeared tied to KCM, but researchers determined it was unrelated and reproducible even with CONFIG_AF_KCM disabled.

Allele Security reproduced the bug on a RHEL-derived 5.14.0-362.24.2.el9_3.x86_64 kernel and on Fedora 39 6.8.6-200.fc39.x86_64, where it initially manifested as refcount warnings. The researchers said Linux refcount protections usually degrade such races into leaks, but in this case a later refcount_set() could overwrite the saturated value and create an unbalanced reference count, enabling premature free; with a modified KASAN-enabled research kernel, they obtained an actual use-after-free report in inet_twsk_put(). Upstream addressed the flaw in commit f2db7230f73a by changing tcp_twsk_unique() to use refcount_inc_not_zero() before taking a reference to the TIME-WAIT socket.