CVE-2024-27392

What it actually does

Double-free of struct nvme_id_ns pointer in ns_update_nuse() after nvme_identify_ns() failure, resulting in KASAN-detected memory corruption.

Why it matters to the business

Potential kernel crashes or instability on systems with NVMe storage; low exploitation likelihood per EPSS but requires prompt patching on affected Linux kernels to avoid denial-of-service conditions.

How an attack unfolds

An attacker with local access triggers an nvme_identify_ns() failure path followed by ns_update_nuse() to force a double kfree on the same nvme_id_ns structure, causing memory corruption observable via KASAN.

How to fix it

Apply kernel patches that skip kfree when nvme_identify_ns() fails; for listed packages upgrade libsdl-org/sdl to commit 00b67f55727bc0944c3266e2b875440da132ce4b and libsdl2 (Debian:12) to 2.26.0+dfsg-1.

How to confirm the fix worked

Reproduce blktests nvme/045 scenario and confirm absence of KASAN double-free reports; verify updated kernel or package versions contain the fix commit.

Typical attack path

1. Obtain local code execution on Linux host with NVMe devices
2. Force nvme_identify_ns() to fail
3. Invoke ns_update_nuse() to trigger second kfree
4. Observe or exploit resulting double-free memory corruption

How to detect it

Search kernel logs for KASAN double-free reports involving nvme_id_ns or ns_update_nuse; examine crash dumps for repeated kfree calls on the same pointer after identify failures.

What your security team should do

• Prioritize kernel updates on all NVMe-equipped Linux systems within standard patch windows
• Monitor EPSS and KEV status for any rise in exploit activity
• Test NVMe-related blktests after patching to validate fix