---
id: CVE-2024-35860
title: 'bpf: support deferring bpf_link dealloc to after RCU grace period'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  bpf: support deferring bpf_link dealloc to after RCU grace period

  BPF link for some program types is passed as a "context" which can be
  used by those BPF programs to l…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 0dcac272540613d41c05e89679e4ddb978b612f1 <
    ac48dc6ac9240f73bf08d29edf65c2deca93ee5d
  - >-
    Linux >= 0dcac272540613d41c05e89679e4ddb978b612f1 <
    876941f533e7b47fc69977fc4551c02f2d18af97
  - >-
    Linux >= 0dcac272540613d41c05e89679e4ddb978b612f1 <
    5d8d447777564b35f67000e7838e7ccb64d525c8
  - >-
    Linux >= 0dcac272540613d41c05e89679e4ddb978b612f1 <
    1a80dbcb2dbaf6e4c216e62e30fa7d3daa8001ce
  - Linux 5.18
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2024-09-10T15:41:33.868687Z'
published: '2024-05-19'
updated: '2026-10-30'
sourceUpdated: '2026-10-30T12:18:16.969Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2024-35860'
references:
  - url: 'https://git.kernel.org/stable/c/ac48dc6ac9240f73bf08d29edf65c2deca93ee5d'
  - url: 'https://git.kernel.org/stable/c/876941f533e7b47fc69977fc4551c02f2d18af97'
  - url: 'https://git.kernel.org/stable/c/5d8d447777564b35f67000e7838e7ccb64d525c8'
  - url: 'https://git.kernel.org/stable/c/1a80dbcb2dbaf6e4c216e62e30fa7d3daa8001ce'
tags:
  - cve.org
epss: 0.00236
epssPercentile: 0.14665
ingestedAt: '2026-11-03T12:44:28.812Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

bpf: support deferring bpf_link dealloc to after RCU grace period

BPF link for some program types is passed as a "context" which can be
used by those BPF programs to look up additional information. E.g., for
multi-kprobes and multi-uprobes, link is used to fetch BPF cookie values.

Because of this runtime dependency, when bpf_link refcnt drops to zero
there could still be active BPF programs running accessing link data.

This patch adds generic support to defer bpf_link dealloc callback to
after RCU GP, if requested. This is done by exposing two different
deallocation callbacks, one synchronous and one deferred. If deferred
one is provided, bpf_link_free() will schedule dealloc_deferred()
callback to happen after RCU GP.

BPF is using two flavors of RCU: "classic" non-sleepable one and RCU
tasks trace one. The latter is used when sleepable BPF programs are
used. bpf_link_free() accommodates that by checking underlying BPF
program's sleepable flag, and goes either through normal RCU GP only for
non-sleepable, or through RCU tasks trace GP *and* then normal RCU GP
(taking into account rcu_trace_implies_rcu_gp() optimization), if BPF
program is sleepable.

We use this for multi-kprobe and multi-uprobe links, which dereference
link during program run. We also preventively switch raw_tp link to use
deferred dealloc callback, as upcoming changes in bpf-next tree expose
raw_tp link data (specifically, cookie value) to BPF program at runtime
as well.

## Affected

- `Linux >= 0dcac272540613d41c05e89679e4ddb978b612f1 < ac48dc6ac9240f73bf08d29edf65c2deca93ee5d`
- `Linux >= 0dcac272540613d41c05e89679e4ddb978b612f1 < 876941f533e7b47fc69977fc4551c02f2d18af97`
- `Linux >= 0dcac272540613d41c05e89679e4ddb978b612f1 < 5d8d447777564b35f67000e7838e7ccb64d525c8`
- `Linux >= 0dcac272540613d41c05e89679e4ddb978b612f1 < 1a80dbcb2dbaf6e4c216e62e30fa7d3daa8001ce`
- `Linux 5.18`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.