CVE-2024-36961

What it actually does

Race conditions in thermal/debugfs allow a NULL pointer dereference when the mitigations file is opened before the debugfs pointer is initialized, and a use-after-free when thermal_debug_tz_remove clears the pointer without proper locking, enabling concurrent access to a freed struct thermal_debugfs object.

Why it matters to the business

Unpatched Linux systems may experience kernel crashes or unexpected behavior during thermal zone management, increasing downtime risk for servers, embedded devices, and cloud workloads that rely on the affected kernel versions; urgency is low given absence from known exploitation lists and stable low exploit probability.

How an attack unfolds

An attacker with local access opens the mitigations debugfs file for a thermal zone before its debugfs structure is fully set up, or races with thermal zone removal to trigger the NULL dereference or premature free, potentially leading to kernel panic or memory corruption.

How to fix it

Update the Linux kernel to a version containing commit 6c57bdd0505422d5ccd2df541d993aec978c842e or later; rebuild and deploy the updated kernel across all affected systems; verify the commit is present in the running kernel source.

How to confirm the fix worked

Confirm the running kernel includes commit 6c57bdd0505422d5ccd2df541d993aec978c842e by checking git log or kernel version strings; attempt to access thermal debugfs mitigations files under concurrent thermal zone operations in a test environment to verify no crashes occur.

Typical attack path

1. Obtain local access on an affected Linux system
2. Interact with thermal debugfs entries for a thermal zone
3. Trigger concurrent thermal zone addition or removal operations
4. Cause NULL dereference or use-after-free in debugfs sequence operations

How to detect it

Review kernel logs for NULL pointer dereference oops messages involving tze_seq_start or thermal_debug_tz_remove; inspect for concurrent thermal zone add/remove patterns around debugfs access; no named threat actors or ransomware campaigns are associated with this issue.

What your security team should do

• Prioritize kernel updates on systems exposing thermal debugfs interfaces
• Monitor for new kernel releases from stable trees after 2024-06-03
• Restrict unprivileged access to /sys/kernel/debug/thermal where possible until patched