CVE-2024-36890

What it actually does

The __free(kfree) cleanup handler in the Linux kernel slab allocator does not check for error-valued pointers before invoking kfree, causing a crash when an ERR_PTR is assigned to an automatically freed variable.

Why it matters to the business

Kernel panics or system instability can occur in device drivers and subsystems that use the __free attribute with functions returning error pointers, leading to unexpected reboots and service disruption on affected Linux systems.

How an attack unfolds

An attacker triggers a code path (such as gpiochip_dup_line_label) that returns an error pointer under failure conditions; the pointer is stored in a __free(kfree) variable whose cleanup routine then dereferences the invalid error value, resulting in a crash. No public in-the-wild exploitation or named threat actors are associated with this issue.

How to fix it

Upgrade the Linux kernel to version 6.1.91 or later, or apply commit edca32f87329d6e341d2143a3b58ec254e8f6b88. Rebuild and reboot all affected systems after the update.

How to confirm the fix worked

Verify the running kernel version is at least 6.1.91, confirm the presence of the edca32f87329 commit in the source tree, and test that error-pointer returns from functions used with __free(kfree) no longer trigger crashes.

Typical attack path

1. Identify a driver or subsystem using __free(kfree) on a function that can return ERR_PTR values
2. Trigger the error condition that causes the function to return an error pointer
3. Allow the automatic cleanup to execute kfree on the error pointer
4. Observe resulting kernel crash or denial of service

How to detect it

Review kernel crash logs for oops or panic entries involving kfree on error pointers or references to wm831x_gpio_dbg_show; no specific post-exploitation artifacts are known.

What your security team should do

• Prioritize patching production kernels within standard maintenance windows given the age of the issue
• Audit internal driver code for __free(kfree) usage on potentially error-returning functions
• Update kernel packages via distribution mechanisms and schedule controlled reboots
• Monitor vendor advisories for backported fixes in LTS branches