CVE-2024-26737

Name of the Vulnerable Software and Affected Versions: Linux kernel (affected versions not specified)

Description: The issue is related to a race condition between bpf timer cancel and free and bpf timer cancel in the Linux kernel, which can lead to a Use After Free (UAF) on the timer->timer. This occurs when bpf timer cancel and bpf timer cancel and free are called concurrently, causing the timer->timer to be accessed after it has been freed. The patch resolves this issue by freeing the timer->timer after a rcu grace period in bpf timer cancel and free, and adding a rcu read lock in bpf timer cancel to prevent the race condition.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.