{"id":"CVE-2024-35955","revision":"2dafa9fbac3e4cf7bce4ea211605fb9b","records":[{"revision":"2dafa9fbac3e4cf7bce4ea211605fb9b","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2024-35955","aliases":[],"title":"kprobes: Fix possible use-after-free issue on kprobe registration","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nkprobes: Fix possible use-after-free issue on kprobe registration\n\nWhen unloading a module, its state is changing MODULE_STATE_LIVE ->\n MODULE_STATE_GOING -> MODULE_STATE_UNFORMED. Each change will take\na time. `is_module_text_address()` and `__module_text_address()`\nworks with MODULE_STATE_LIVE and MODULE_STATE_GOING.\nIf we use `is_module_text_address()` and `__module_text_address()`\nseparately, there is a chance that the first one is succeeded but the\nnext one is failed because module->state becomes MODULE_STATE_UNFORMED\nbetween those operations.\n\nIn `check_kprobe_address_safe()`, if the second `__module_text_address()`\nis failed, that is ignored because it expected a kernel_text address.\nBut it may have failed simply because module->state has been changed\nto MODULE_STATE_UNFORMED. In this case, arm_kprobe() will try to modify\nnon-exist module text address (use-after-free).\n\nTo fix this problem, we should not use separated `is_module_text_address()`\nand `__module_text_address()`, but use only `__module_text_address()`\nonce and do `try_module_get(module)` which is only available with\nMODULE_STATE_LIVE.","state":0,"publishedAt":"2024-05-20T09:41:48.607+00:00","modifiedAt":"2026-10-15T00:41:40.501+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"kernel/kprobes.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"1c836bad43f3e2ff71cc397a6e6ccb4e7bd116f8\",\n                            \"lessThan\": \"b5808d40093403334d939e2c3c417144d12a6f33\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"6a119c1a584aa7a2c6216458f1f272bf1bc93a93\",\n                            \"lessThan\": \"93eb31e7c3399e326259f2caa17be1e821f5a412\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"2a49b025c36ae749cee7ccc4b7e456e02539cdc3\",\n                            \"lessThan\": \"5062d1f4f07facbdade0f402d9a04a788f52e26d\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"a1edb85e60fdab1e14db63ae8af8db3f0d798fb6\",\n                            \"lessThan\": \"2df2dd27066cdba8041e46a64362325626bdfb2e\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"28f6c37a2910f565b4f5960df52b2eccae28c891\",\n                            \"lessThan\": \"62029bc9ff2c17a4e3a2478d83418ec575413808\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"28f6c37a2910f565b4f5960df52b2eccae28c891\",\n                            \"lessThan\": \"d15023fb407337028a654237d8968fefdcf87c2f\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"28f6c37a2910f565b4f5960df52b2eccae28c891\",\n                            \"lessThan\": \"36b57c7d2f8b7de224980f1a284432846ad71ca0\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"28f6c37a2910f565b4f5960df52b2eccae28c891\",\n                            \"lessThan\": \"325f3fb551f8cd672dbbfc4cf58b14f9ee3fc9e8\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"4262b6eb057d86c7829168c541654fe0d48fdac8\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"97e813e6a143edf4208e15c72199c495ed80cea5\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"16a544f1e013ba0660612f3fe35393b143b19a84\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"4.19.256\",\n                            \"lessThan\": \"4.19.313\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.4.211\",\n                            \"lessThan\": \"5.4.275\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.10.137\",\n                            \"lessThan\": \"5.10.216\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.61\",\n                            \"lessThan\": \"5.15.157\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"4.14.291\",\n                            \"lessThan\": \"4.15\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.18.18\",\n                            \"lessThan\": \"5.19\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.19.2\",\n                            \"lessThan\": \"5.20\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"kernel/kprobes.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"6.0\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"6.0\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"4.19.313\",\n                            \"lessThanOrEqual\": \"4.19.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.4.275\",\n                            \"lessThanOrEqual\": \"5.4.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.10.216\",\n                            \"lessThanOrEqual\": \"5.10.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.157\",\n                            \"lessThanOrEqual\": \"5.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.87\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.28\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.8.7\",\n                            \"lessThanOrEqual\": \"6.8.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.9\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://git.kernel.org/stable/c/b5808d40093403334d939e2c3c417144d12a6f33","https://git.kernel.org/stable/c/93eb31e7c3399e326259f2caa17be1e821f5a412","https://git.kernel.org/stable/c/5062d1f4f07facbdade0f402d9a04a788f52e26d","https://git.kernel.org/stable/c/2df2dd27066cdba8041e46a64362325626bdfb2e","https://git.kernel.org/stable/c/62029bc9ff2c17a4e3a2478d83418ec575413808","https://git.kernel.org/stable/c/d15023fb407337028a654237d8968fefdcf87c2f","https://git.kernel.org/stable/c/36b57c7d2f8b7de224980f1a284432846ad71ca0","https://git.kernel.org/stable/c/325f3fb551f8cd672dbbfc4cf58b14f9ee3fc9e8"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2024-35955","license":"CVE Program Terms of Use","key":"cve-program:CVE-2024-35955","identifiers":["CVE-2024-35955"]},"retained":false,"historicalAffected":[]}],"coverage":[]}