CVE-2024-26737: 
Linux Kernel vulnerability analysis and mitigation

CVE-2024-26737 addresses a race condition vulnerability in the Linux kernel's BPF (Berkeley Packet Filter) subsystem, specifically between bpf_timer_cancel_and_free and bpf_timer_cancel functions. The vulnerability was discovered and disclosed on April 3, 2024, affecting the Linux kernel's timer management functionality (NVD).

The vulnerability stems from a race condition that can lead to a Use-After-Free (UAF) vulnerability on the timer->timer object. The race occurs when bpf_timer_cancel() and bpf_timer_cancel_and_free() functions execute concurrently, potentially causing a memory corruption issue. The CVSS v3.1 base score is 5.5 (Medium), with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (CISA-ADP).

The vulnerability can lead to a Use-After-Free condition, which could potentially result in system crashes or denial of service. The impact is primarily focused on system availability, with no direct impact on confidentiality or integrity (NVD).

The vulnerability requires local access and low privileges to exploit. The default Red Hat Enterprise Linux kernel prevents unprivileged users from being able to use eBPF through the kernel.unprivileged_bpf_disabled sysctl, which helps mitigate the risk (Red Hat).

The vulnerability has been patched by modifying the bpf_timer_cancel_and_free function to free the timer->timer after an RCU grace period and adding rcu_read_lock() to bpf_timer_cancel. The fix includes adding an rcu_head to the 'struct bpf_hrtimer' and using kfree_rcu instead of direct kfree (Kernel Commit).