Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-gftv-431a-q3gy
Vulnerability ID VCID-gftv-431a-q3gy
Aliases CVE-2024-41045
Summary In the Linux kernel, the following vulnerability has been resolved: bpf: Defer work in bpf_timer_cancel_and_free Currently, the same case as previous patch (two timer callbacks trying to cancel each other) can be invoked through bpf_map_update_elem as well, or more precisely, freeing map elements containing timers. Since this relies on hrtimer_cancel as well, it is prone to the same deadlock situation as the previous patch. It would be sufficient to use hrtimer_try_to_cancel to fix this problem, as the timer cannot be enqueued after async_cancel_and_free. Once async_cancel_and_free has been done, the timer must be reinitialized before it can be armed again. The callback running in parallel trying to arm the timer will fail, and freeing bpf_hrtimer without waiting is sufficient (given kfree_rcu), and bpf_timer_cb will return HRTIMER_NORESTART, preventing the timer from being rearmed again. However, there exists a UAF scenario where the callback arms the timer before entering this function, such that if cancellation fails (due to timer callback invoking this routine, or the target timer callback running concurrently). In such a case, if the timer expiration is significantly far in the future, the RCU grace period expiration happening before it will free the bpf_hrtimer state and along with it the struct hrtimer, that is enqueued. Hence, it is clear cancellation needs to occur after async_cancel_and_free, and yet it cannot be done inline due to deadlock issues. We thus modify bpf_timer_cancel_and_free to defer work to the global workqueue, adding a work_struct alongside rcu_head (both used at _different_ points of time, so can share space). Update existing code comments to reflect the new state of affairs.
Status Published
Exploitability 0.5
Weighted Severity 3.7
Risk 1.9
Affected and Fixed Packages Package Details
Weaknesses (1)
CWE-833 Deadlock
System Score Found at
cvssv3 4.1 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-41045.json
epss 0.00013 https://api.first.org/data/v1/epss?cve=CVE-2024-41045
epss 0.00013 https://api.first.org/data/v1/epss?cve=CVE-2024-41045
epss 0.00013 https://api.first.org/data/v1/epss?cve=CVE-2024-41045
cvssv3.1 6.4 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
ssvc Track https://git.kernel.org/stable/c/7aa5a19279c3639ae8b758b63f05d0c616a39fa1
ssvc Track https://git.kernel.org/stable/c/a6fcd19d7eac1335eb76bc16b6a66b7f574d1d69
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-41045.json
https://api.first.org/data/v1/epss?cve=CVE-2024-41045
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
2300415 https://bugzilla.redhat.com/show_bug.cgi?id=2300415
7aa5a19279c3639ae8b758b63f05d0c616a39fa1 https://git.kernel.org/stable/c/7aa5a19279c3639ae8b758b63f05d0c616a39fa1
a6fcd19d7eac1335eb76bc16b6a66b7f574d1d69 https://git.kernel.org/stable/c/a6fcd19d7eac1335eb76bc16b6a66b7f574d1d69
USN-7089-1 https://usn.ubuntu.com/7089-1/
USN-7089-2 https://usn.ubuntu.com/7089-2/
USN-7089-3 https://usn.ubuntu.com/7089-3/
USN-7089-4 https://usn.ubuntu.com/7089-4/
USN-7089-5 https://usn.ubuntu.com/7089-5/
USN-7089-6 https://usn.ubuntu.com/7089-6/
USN-7089-7 https://usn.ubuntu.com/7089-7/
USN-7090-1 https://usn.ubuntu.com/7090-1/
USN-7095-1 https://usn.ubuntu.com/7095-1/
USN-7156-1 https://usn.ubuntu.com/7156-1/
No exploits are available.
Vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-41045.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-09-10T16:23:00Z/ Found at https://git.kernel.org/stable/c/7aa5a19279c3639ae8b758b63f05d0c616a39fa1
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-09-10T16:23:00Z/ Found at https://git.kernel.org/stable/c/a6fcd19d7eac1335eb76bc16b6a66b7f574d1d69
Exploit Prediction Scoring System (EPSS)
Percentile 0.02288
EPSS Score 0.00013
Published At June 5, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-04T16:51:07.186518+00:00 Debian Importer Import https://security-tracker.debian.org/tracker/data/json 38.6.0