CVE-2024-36904 is a use-after-free vulnerability identified in the Linux kernel's TCP stack, specifically within the tcp_twsk_unique() function. The vulnerability arises due to a race condition introduced after commit ec94c2696f0b, which modified the handling of TIME-WAIT sockets in the inet_twsk_hashdance() function. This commit sets the socket's reference count (sk_refcnt) after placing the TIME-WAIT socket into the ehash and releasing the bucket lock, creating a small window where concurrent threads can attempt to reuse the port during a connect() call. During this window, if another thread calls sock_hold() on the TIME-WAIT socket with a zero reference count, the reference count increment is incorrectly handled. The tcp_twsk_unique() function uses a standard increment rather than a safe conditional increment, leading to an underflow in the reference count when sock_put() is later called. This underflow triggers a use-after-free condition, where the kernel may access freed memory, potentially causing system instability or crashes. The patch involves replacing the reference count increment with refcount_inc_not_zero(), which only increments if the count is non-zero, thereby preventing reuse of the port in this race window and eliminating the use-after-free scenario. The vulnerability was reported by Anderson Nascimento and affects Linux kernel versions including and around commit ec94c2696f0b. There are no known exploits in the wild at the time of publication, and no CVSS score has been assigned yet.

For European organizations, this vulnerability poses a risk primarily to systems running vulnerable Linux kernel versions, which are widely used in servers, cloud infrastructure, and embedded devices across Europe. Exploitation could lead to kernel crashes or denial of service (DoS) conditions, impacting availability of critical services. In environments with high concurrency and network connection rates, the race condition could be triggered more frequently, increasing the risk of instability. Although no direct remote code execution or privilege escalation is indicated, the use-after-free could potentially be leveraged in complex attack chains to escalate privileges or bypass security mechanisms if combined with other vulnerabilities. Given the prevalence of Linux in European data centers, telecommunications, and government infrastructure, the vulnerability could disrupt operations if exploited or triggered unintentionally. The lack of known exploits reduces immediate risk, but the vulnerability's nature warrants prompt patching to maintain system reliability and security.

European organizations should prioritize updating Linux kernels to versions that include the fix for CVE-2024-36904, specifically those incorporating the patch that replaces the reference count increment with refcount_inc_not_zero() in tcp_twsk_unique(). Kernel updates should be tested and deployed promptly in production environments, especially on systems handling high volumes of TCP connections. For environments where immediate patching is not feasible, organizations should monitor kernel logs for refcount warnings or crashes indicative of this issue. Network administrators can also consider limiting unnecessary TCP connection churn or implementing connection rate limiting to reduce the likelihood of triggering the race condition. Additionally, organizations should maintain robust kernel crash recovery and monitoring mechanisms to quickly detect and respond to instability potentially caused by this vulnerability. Coordination with Linux distribution vendors for timely patch releases and advisories is recommended to ensure comprehensive coverage.