---
id: CVE-2024-26737
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  bpf: Fix racing between bpf_timer_cancel_and_free and bpf_timer_cancel

  The following race is possible between bpf_timer_cancel_and_free
  and bpf_timer_cancel
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  bpf: Fix racing between bpf_timer_cancel_and_free and bpf_timer_cancel

  The following race is possible between bpf_timer_cancel_and_free
  and bpf_timer_cancel. It will l…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-416
vendor: linux
product: linux_kernel
affected:
  - 'linux_kernel >= 5.15, < 5.15.150'
  - 'linux_kernel >= 5.16, < 6.1.80'
  - 'linux_kernel >= 6.2, < 6.6.19'
  - 'linux_kernel >= 6.7, < 6.7.7'
  - linux_kernel = 6.8
patched:
  - linux_kernel 6.7.7
published: '2024-04-03'
updated: '2026-08-04'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2024-26737'
references:
  - url: 'https://git.kernel.org/stable/c/0281b919e175bb9c3128bd3872ac2903e9436e3f'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/5268bb02107b9eedfdcd51db75b407d10043368c'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/7d80a9e745fa5b47da3bca001f186c02485c7c33'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/8327ed12e8ebc5436bfaa1786c49988894f9c8a6'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/addf5e297e6cbf5341f9c07720693ca9ba0057b5'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/0281b919e175bb9c3128bd3872ac2903e9436e3f'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://git.kernel.org/stable/c/5268bb02107b9eedfdcd51db75b407d10043368c'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://git.kernel.org/stable/c/7d80a9e745fa5b47da3bca001f186c02485c7c33'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://git.kernel.org/stable/c/8327ed12e8ebc5436bfaa1786c49988894f9c8a6'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://git.kernel.org/stable/c/addf5e297e6cbf5341f9c07720693ca9ba0057b5'
    label: af854a3a-2127-422b-91ae-364da2661108
tags:
  - nvd
epss: 0.00251
epssPercentile: 0.14633
ingestedAt: '2026-08-05T10:46:48.361Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix racing between bpf_timer_cancel_and_free and bpf_timer_cancel

The following race is possible between bpf_timer_cancel_and_free
and bpf_timer_cancel. It will lead a UAF on the timer->timer.

bpf_timer_cancel();
	spin_lock();
	t = timer->time;
	spin_unlock();

					bpf_timer_cancel_and_free();
						spin_lock();
						t = timer->timer;
						timer->timer = NULL;
						spin_unlock();
						hrtimer_cancel(&t->timer);
						kfree(t);

	/* UAF on t */
	hrtimer_cancel(&t->timer);

In bpf_timer_cancel_and_free, this patch frees the timer->timer
after a rcu grace period. This requires a rcu_head addition
to the "struct bpf_hrtimer". Another kfree(t) happens in bpf_timer_init,
this does not need a kfree_rcu because it is still under the
spin_lock and timer->timer has not been visible by others yet.

In bpf_timer_cancel, rcu_read_lock() is added because this helper
can be used in a non rcu critical section context (e.g. from
a sleepable bpf prog). Other timer->timer usages in helpers.c
have been audited, bpf_timer_cancel() is the only place where
timer->timer is used outside of the spin_lock.

Another solution considered is to mark a t->flag in bpf_timer_cancel
and clear it after hrtimer_cancel() is done.  In bpf_timer_cancel_and_free,
it busy waits for the flag to be cleared before kfree(t). This patch
goes with a straight forward solution and frees timer->timer after
a rcu grace period.

## Affected

- `linux_kernel >= 5.15, < 5.15.150`
- `linux_kernel >= 5.16, < 6.1.80`
- `linux_kernel >= 6.2, < 6.6.19`
- `linux_kernel >= 6.7, < 6.7.7`
- `linux_kernel = 6.8`

## Remediation

Upgrade past the affected range:

- `linux_kernel 6.7.7`