CVE-2024-36002

What it actually does

Use-after-free in dpll_pin_on_pin_register when a pin registered with multiple parents on the same dpll device is unregistered a second time, causing access to already-freed registration resources.

Why it matters to the business

Kernel crashes or potential local code execution on systems with affected dpll hardware (such as E810T NICs) during driver unload or pin unregistration; high prevalence in Linux distributions amplifies patch urgency.

How an attack unfolds

An attacker with local access triggers repeated pin registration/unregistration sequences (for example via crafted driver load/unload or hardware events) to reuse freed memory structures, leading to a call trace or exploitable memory corruption during dpll operations.

How to fix it

Upgrade the Linux kernel to commit e8f897f4afef0031fe618a8e94127a0934896aba or later; rebuild and reboot with the patched kernel; verify dpll pin handling code contains the parent-pointer cookie fix.

How to confirm the fix worked

Confirm the running kernel contains commit e8f897f4afef0031fe618a8e94127a0934896aba; exercise dpll_pin_on_pin_register/unregister paths with multiple parents and ensure no WARNING at dpll_core.c:809 occurs.

Typical attack path

1. Obtain local access or control over a process that can manipulate dpll pins
2. Register a pin with multiple parents on the same dpll device
3. Trigger second unregistration to hit the freed resource path
4. Leverage resulting UAF for kernel memory corruption or denial of service

How to detect it

Review kernel logs for WARNING at drivers/dpll/dpll_core.c:809 dpll_pin_ops during ice driver removal or dpll unregistration events; inspect call traces containing dpll_pin_on_pin_unregister and ice_dpll_deinit_pins.

• WARNING: CPU:.*PID:.*at drivers/dpll/dpll_core.c:809 dpll_pin_ops
• dpll_pin_on_pin_unregister+0x3f/0x100
• ice_dpll_deinit_pins+0xa1/0x230

What your security team should do

• Prioritize kernel upgrade to the fixed commit on all systems exposing dpll devices
• Monitor for kernel oops or WARNING messages referencing dpll_pin_ops during hardware/driver removal
• Restrict unprivileged local access until patches are deployed