CVE-2024-36899

What it actually does

Use-after-free of the watched_lines bitmap in gpio character device due to race between bitmap_free in gpio_chrdev_release and blocking_notifier_call_chain during gpiod_free while holding notifier rwsem.

Why it matters to the business

Linux systems using GPIO character devices face kernel memory corruption risk during concurrent device release and line state notifications, potentially causing crashes or instability; high urgency for kernel updates given widespread Linux deployment.

How an attack unfolds

An attacker triggers gpio_chrdev_release to free watched_lines while a concurrent gpiod_free path holds the notifier read rwsem and invokes lineinfo_changed_notify to access the freed bitmap, exploiting the failed unregistration under write rwsem contention.

How to fix it

Upgrade Linux kernel to commit 2dfbb920a89bdc58087672ad5325dc6c588b6860 or later stable release containing the fix that moves bitmap_free after blocking_notifier_chain_unregister.

How to confirm the fix worked

Verify kernel source contains the reordered bitmap_free call after notifier unregistration; boot patched kernel and confirm no use-after-free reports under concurrent GPIO open/close and line free workloads.

Typical attack path

1. Open GPIO chip character device and register lineinfo changed notifier
2. Initiate concurrent close of the device file triggering gpio_chrdev_release
3. Trigger GPIO line free via another path such as st54spi_gpio_dev_release
4. Race the bitmap_free with notifier chain callback accessing watched_lines

How to detect it

Inspect kernel logs for use-after-free warnings referencing watched_lines or lineinfo_changed_notify; review audit logs for concurrent GPIO chrdev open/close and gpiod_free operations around crash timestamps.

What your security team should do

• Apply the referenced kernel commit immediately on all affected systems
• Prioritize updates for systems exposing GPIO character devices to untrusted processes
• Monitor for kernel oops or slab corruption related to gpio cdev watched_lines