CVE-2024-35955kprobes: Fix possible use-after-free issue on kprobe registration
Updated under an hour ago ()
Does this affect you?
It affects Linux and 6 other products. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: kprobes: Fix possible use-after-free issue on kprobe registration When unloading a module, its state is changing MODULE_STATE_LIVE -> MODULE_STATE_GOING -> MODULE_STATE_UNFORMED. Each change will take a time. `is_module_text_address()` and `__module_text_address()` works with MODULE_STATE_LIVE and MODULE_STATE_GOING. If we use `is_module_text_address()` and `__module_text_address()` separately, there is a chance that the first one is succeeded but the next one is failed because module->state becomes MODULE_STATE_UNFORMED between those operations. In `check_kprobe_address_safe()`, if the second `__module_text_address()` is failed, that is ignored because it expected a kernel_text address. But it may have failed simply because module->state has been changed to MODULE_STATE_UNFORMED. In this case, arm_kprobe() will try to modify non-exist module text address (use-after-free). To fix this problem, we should not use separated `is_module_text_address()` and `__module_text_address()`, but use only `__module_text_address()` once and do `try_module_get(module)` which is only available with MODULE_STATE_LIVE.
- CVSS
- 8.8 HIGH (v3.1, CISA ADP)CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- CWE-416
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Modified
- Record last updated
- Oct 15, 2026
- First seen by InfoSec Signals
- Oct 15, 2026
Affected products
Linux Linux linux:linux (from the name) | from 1c836bad43f3e2ff71cc397a6e6ccb4e7bd116f8 before b5808d40093403334d939e2c3c417144d12a6f33; from 6a119c1a584aa7a2c6216458f1f272bf1bc93a93 before 93eb31e7c3399e326259f2caa17be1e821f5a412; from 2a49b025c36ae749cee7ccc4b7e456e02539cdc3 before 5062d1f4f07facbdade0f402d9a04a788f52e26d; from a1edb85e60fdab1e14db63ae8af8db3f0d798fb6 before 2df2dd27066cdba8041e46a64362325626bdfb2e; from 28f6c37a2910f565b4f5960df52b2eccae28c891 before 62029bc9ff2c17a4e3a2478d83418ec575413808; from 28f6c37a2910f565b4f5960df52b2eccae28c891 before d15023fb407337028a654237d8968fefdcf87c2f; from 28f6c37a2910f565b4f5960df52b2eccae28c891 before 36b57c7d2f8b7de224980f1a284432846ad71ca0; from 28f6c37a2910f565b4f5960df52b2eccae28c891 before 325f3fb551f8cd672dbbfc4cf58b14f9ee3fc9e8; and 10 more ranges | CNA record |
linux linux_kernel linux:linux_kernel | from 1c836bad43f3 before b5808d400934; from 6a119c1a584a before 93eb31e7c339; from 2a49b025c36a before 93eb31e7c339; from a1edb85e60fd before 2df2dd27066c; from 28f6c37a2910 before 62029bc9ff2c; from 28f6c37a2910 before d15023fb4073; from 28f6c37a2910 before 36b57c7d2f8b; from 28f6c37a2910 before 325f3fb551f8; and 1 more ranges | CISA ADP |
Siemens RUGGEDCOM RST2428P siemens:ruggedcom_rst2428p (from the name) | before V3.1 | CISA ADP |
Siemens SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family siemens:scalance_xc_300_xr_300_xc_400_xr_500wg_xr_500_family (from the name) | all versions not affected | CISA ADP |
Siemens SCALANCE XCM-/XRM-/XCH-/XRH-300 family siemens:scalance_xcm_xrm_xch_xrh_300_family (from the name) | before V3.1 | CISA ADP |
Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem siemens:simatic_s7_1500_tm_mfp_gnu_linux_subsystem (from the name) | before V1.1.1 | CISA ADP |
linux linux_kernel linux:linux_kernel | from 4.14.291 before 4.15; from 4.19.256 before 4.19.313; from 5.4.211 before 5.4.275; from 5.10.137 before 5.10.216; from 5.15.61 before 5.15.157; from 5.18.18 before 5.19; from 5.19.2 before 6.1.87; from 6.2 before 6.6.28; and 4 more ranges | NVD |
debian debian_linux debian:debian_linux | 10.0 | NVD |
References
- https://git.kernel.org/stable/c/b5808d40093403334d939e2c3c417144d12a6f33patch
- https://git.kernel.org/stable/c/93eb31e7c3399e326259f2caa17be1e821f5a412patch
- https://git.kernel.org/stable/c/5062d1f4f07facbdade0f402d9a04a788f52e26dpatch
- https://git.kernel.org/stable/c/2df2dd27066cdba8041e46a64362325626bdfb2epatch
- https://git.kernel.org/stable/c/62029bc9ff2c17a4e3a2478d83418ec575413808patch
- https://git.kernel.org/stable/c/d15023fb407337028a654237d8968fefdcf87c2fpatch
- https://git.kernel.org/stable/c/36b57c7d2f8b7de224980f1a284432846ad71ca0patch
- https://git.kernel.org/stable/c/325f3fb551f8cd672dbbfc4cf58b14f9ee3fc9e8patch
- https://lists.debian.org/debian-lts-announce/2024/06/msg00017.htmlmailing-list, third-party-advisory
- https://lists.debian.org/debian-lts-announce/2024/06/msg00020.htmlmailing-list, third-party-advisory
- https://cert-portal.siemens.com/productcert/html/ssa-265688.html
- https://cert-portal.siemens.com/productcert/html/ssa-613116.html
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.