CVE-2024-58060 bpf: Reject struct_ops registration that uses module ptr and the module btf_id is missing
A use-after-free in the Linux kernel BPF subsystem allows attackers to execute arbitrary code or escalate privileges when CONFIG_MODULES is disabled.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-58060?
CVE-2024-58060 is a high-severity use after free vulnerability in Linux kernel, published on 6 Mar 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
bpf: Reject struct_ops registration that uses module ptr and the module btf_id is missing
There is a UAF report in the bpf_struct_ops when CONFIG_MODULES=n. In particular, the report is on tcp_congestion_ops that has a "struct module *owner" member.
For struct_ops that has a "struct module *owner" member, it can be extended either by the regular kernel module or by the bpf_struct_ops. bpf_try_module_get() will be used to do the refcounting and different refcount is done based on the owner pointer. When CONFIG_MODULES=n, the btf_id of the "struct module" is missing:
WARN: resolve_btfids: unresolved symbol module
Thus, the bpf_try_module_get() cannot do the correct refcounting.
Not all subsystem's struct_ops requires the "struct module *owner" member. e.g. the recent sched_ext_ops.
This patch is to disable bpf_struct_ops registration if the struct_ops has the "struct module *" member and the "struct module" btf_id is missing. The btf_type_is_fwd() helper is moved to the btf.h header file for this test.
This has happened since the beginning of bpf_struct_ops which has gone through many changes. The Fixes tag is set to a recent commit that this patch can apply cleanly. Considering CONFIG_MODULES=n is not common and the age of the issue, targeting for bpf-next also.
Weakness: CWE-416
Which versions are affected by CVE-2024-58060?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2024-58060?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2024-58060 being exploited?
There is no known exploitation of CVE-2024-58060 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2024-58060, DEBIAN-CVE-2024-58060, GHSA-4hqc-3j39-58mh, UBUNTU-CVE-2024-58060.