CVE-2024-27043

What it actually does

Use-after-free in dvb_register_device where *pdvbdev is not nulled after dvbdev deallocation in error paths, allowing dmxdev->dvbdev to reference freed memory passed to kref_put during dvb_unregister_device.

Why it matters to the business

Linux systems with DVB media hardware face risk of kernel crashes or potential privilege escalation, leading to service disruption on affected servers or embedded devices until kernels are updated.

How an attack unfolds

An attacker with local access triggers error paths during dvb_register_device via budget_register and dvb_dmxdev_init, leaving a dangling pointer that is dereferenced in dvb_unregister_device and kref_put to cause use-after-free.

How to fix it

Update the Linux kernel to commit d0f5c28333822f9baa5280d813124920720fd856 or a later stable release containing the fix; rebuild and deploy the patched kernel across all affected systems.

How to confirm the fix worked

Confirm kernel source contains commit d0f5c28333822f9baa5280d813124920720fd856; verify dvb_register_device now sets *pdvbdev to NULL after deallocation and test DVB device registration/unregistration paths.

Typical attack path

1. Obtain local access on Linux system with DVB subsystem enabled
2. Invoke media device registration paths that hit error handling in dvb_register_device
3. Trigger dvb_dmxdev_release to call dvb_unregister_device on the dangling pointer
4. Force kref_put on freed dvbdev memory to achieve use-after-free

How to detect it

Inspect kernel logs for use-after-free oops involving dvbdev, dvb_unregister_device, or kref_put; review audit logs for unusual DVB device registration attempts.

What your security team should do

• Prioritize kernel updates on any systems exposing DVB or media subsystems
• Review and restrict unprivileged access to /dev/dvb* devices
• Monitor for kernel oops or panic logs related to dvbdev after applying the fix