CVE-2024-58060 is a high-severity vulnerability in the Linux kernel related to the Berkeley Packet Filter (BPF) subsystem, specifically involving the registration of bpf_struct_ops when kernel modules are disabled (CONFIG_MODULES=n). The vulnerability arises from a use-after-free (UAF) condition in the bpf_struct_ops implementation. The issue centers on the handling of the "struct module *owner" member within struct_ops such as tcp_congestion_ops. Normally, when kernel modules are enabled, bpf_try_module_get() manages reference counting on the module owner pointer to prevent premature freeing. However, when CONFIG_MODULES is disabled, the BPF Type Format (BTF) ID for "struct module" is missing, causing the bpf_try_module_get() function to fail in correctly performing reference counting. This leads to unresolved symbol warnings and ultimately a use-after-free scenario. The vulnerability has existed since the inception of bpf_struct_ops but is mitigated by a patch that disables bpf_struct_ops registration if the struct_ops contains a "struct module *" member and the corresponding BTF ID is missing. This patch prevents the unsafe registration path that leads to the UAF. The vulnerability affects Linux kernel versions identified by the given commit hashes and is relevant primarily in configurations where kernel modules are disabled, which is uncommon. The CVSS 3.1 score is 7.8 (high), reflecting the local attack vector, low attack complexity, required privileges, no user interaction, and high impact on confidentiality, integrity, and availability. No known exploits are reported in the wild yet. This vulnerability is categorized under CWE-416 (Use After Free).

For European organizations, the impact of CVE-2024-58060 depends largely on their Linux deployment configurations. Systems running Linux kernels with CONFIG_MODULES disabled are vulnerable to a use-after-free condition that can be exploited by local attackers with limited privileges to escalate privileges or cause denial of service. Although the attack vector is local, the high impact on confidentiality, integrity, and availability means that successful exploitation could lead to full system compromise, data leakage, or disruption of critical services. This is particularly concerning for organizations operating critical infrastructure, telecommunications, or cloud services that rely on hardened Linux environments with modules disabled for security or compliance reasons. The vulnerability could also affect embedded Linux devices or specialized appliances common in industrial control systems or network equipment used in Europe. Since the vulnerability affects the BPF subsystem, which is widely used for networking and tracing, exploitation could undermine network security monitoring or traffic control mechanisms. However, the rarity of the CONFIG_MODULES=n configuration in typical enterprise Linux distributions somewhat limits the exposure. Nonetheless, organizations with custom or minimal Linux builds should assess their risk carefully.

European organizations should first identify Linux systems running kernels with CONFIG_MODULES disabled, as these are the primary vulnerable targets. They should apply the latest Linux kernel patches that include the fix disabling unsafe bpf_struct_ops registration in these configurations. If patching is not immediately feasible, organizations should consider enabling kernel modules (CONFIG_MODULES=y) if operationally acceptable, as this mitigates the vulnerability by restoring proper module reference counting. Additionally, restricting local user access and enforcing strict privilege separation can reduce the risk of exploitation. Monitoring kernel logs for WARN messages related to unresolved BTF symbols may help detect attempts to trigger the vulnerability. For embedded or specialized devices, vendors should be engaged to provide updated firmware or kernel versions. Network segmentation and limiting access to critical Linux hosts can further reduce attack surface. Finally, organizations should maintain robust incident detection capabilities to identify potential exploitation attempts early.