CVE-2024-38385

What it actually does

Use-after-free in irq_find_at_or_after() where an interrupt descriptor returned by mt_find() is dereferenced without holding sparse_irq_lock or an RCU read lock, allowing the descriptor to be freed (via delayed_free_desc) between lookup and access.

Why it matters to the business

Linux kernel systems may experience crashes, denial of service, or potential privilege escalation when interrupt statistics or related proc interfaces are accessed concurrently with descriptor freeing, increasing downtime and security risk for servers, embedded devices, and Android-based products until patched.

How an attack unfolds

An attacker triggers concurrent access to IRQ descriptors (for example via /proc/stat reads) while another thread performs descriptor release through RCU callbacks; the race allows a freed descriptor to be dereferenced, leading to KASAN-detected use-after-free that can be turned into memory corruption or control-flow hijacking in the kernel.

How to fix it

Update the Linux kernel to a version containing commit 1c7891812d85500ae2ca4051fa5683fcf29930d8 which adds the required RCU read lock around the mt_find() result access; rebuild and reboot all affected systems.

How to confirm the fix worked

Verify the presence of the RCU read lock guard in irq_find_at_or_after() or confirm the kernel build contains commit 1c7891812d85500ae2ca4051fa5683fcf29930d8; re-run KASAN-enabled tests that previously reproduced the race to confirm absence of the use-after-free report.

Typical attack path

1. Identify a Linux system exposing proc interfaces or IRQ statistics.
2. Trigger repeated reads of IRQ-related proc files while forcing IRQ descriptor allocation and freeing.
3. Exploit the window between mt_find() and subsequent dereference to access a freed irq_desc.
4. Leverage resulting memory corruption for kernel code execution or crash.

How to detect it

Search kernel logs and KASAN reports for the call trace containing irq_get_next_irq, show_stat, irq_kobj_release, delayed_free_desc, and rcu_do_batch; inspect RCU-related freeing paths around IRQ descriptor objects.

• irq_get_next_irq+0x58/0x84
• delayed_free_desc+0x14/0x2c
• irq_kobj_release+0x28/0x3c
• show_stat+0x638/0x824
• KASAN: use-after-free in irq_find_at_or_after

What your security team should do

• Prioritize kernel updates containing commit 1c7891812d85500ae2ca4051fa5683fcf29930d8 on all production Linux hosts.
• Monitor vendor advisories for backported fixes in distribution kernels.
• Enable kernel hardening features such as KASAN in test environments to validate the fix.
• Review and restrict unprivileged access to proc interfaces that trigger IRQ enumeration where feasible.