CVE-2024-37021

What it actually does

Null pointer dereference in fpga manager registration and get functions when the parent device lacks a driver, caused by relying on the driver's owner pointer without validation; the fix adds an explicit module owner field to fpga_manager and updates registration helpers.

Why it matters to the business

Systems using FPGA hardware on affected kernels risk unexpected crashes or instability during manager initialization, leading to downtime or degraded hardware functionality in specialized computing environments.

How an attack unfolds

An attacker with local access loads or interacts with an FPGA manager module in a context where the parent device has no associated driver, triggering __fpga_mgr_get or related paths that dereference a null owner pointer and cause a kernel crash.

How to fix it

Upgrade the Linux kernel to commit 304f8032d601d4f9322ca841cd0b573bd1beb158 or later stable releases that include the updated fpga_manager registration interface and owner handling.

How to confirm the fix worked

Verify the running kernel contains commit 304f8032d601d4f9322ca841cd0b573bd1beb158; confirm absence of the old registration functions without explicit owner parameter and test FPGA manager initialization on devices without drivers.

Typical attack path

1. Identify or create conditions where an FPGA parent device is present without a loaded driver
2. Invoke fpga_mgr_get, of_fpga_mgr_get or equivalent registration paths from a low-privilege process or module
3. Trigger the null dereference during refcount acquisition
4. Cause kernel panic or denial of service

How to detect it

Search kernel logs for null pointer dereference oops mentioning fpga_manager, __fpga_mgr_get, or fpga_mgr_get around device registration; correlate with module load events for FPGA-related drivers.

What your security team should do

• Apply the fixed kernel commit immediately on any system exposing FPGA manager interfaces
• Audit custom low-level FPGA control modules for use of the legacy registration helpers
• Monitor for kernel oops reports involving fpga_mgr during hardware bring-up
• Restrict unprivileged access to FPGA device nodes until patched