CVE-2024-38627

What it actually does

Double free in stm_register_device() where put_device triggers stm_device_release to free the stm structure, followed by an unconditional vfree on the same pointer.

Why it matters to the business

Kernel memory corruption on affected Linux systems can lead to crashes, denial of service, or potential privilege escalation; urgency remains low given stable low exploit probability and no known campaigns.

How an attack unfolds

An attacker with the ability to trigger stm_register_device registration paths supplies conditions that cause the put_device path to release the structure, after which the subsequent vfree re-frees the already-freed memory, enabling use-after-free manipulation.

How to fix it

Update the Linux kernel to the commit 6cc30ef8eb6d8f8d6df43152264bbf8835d99931 or later stable releases that contain the fix; rebuild and reboot affected systems.

How to confirm the fix worked

Confirm the running kernel contains commit 6cc30ef8eb6d8f8d6df43152264bbf8835d99931 via git log or kernel version strings; attempt to load stm devices and monitor for double-free warnings in dmesg.

Typical attack path

1. Obtain local or module-loading access on a vulnerable kernel build
2. Invoke code paths that call stm_register_device with a device that will be put
3. Trigger the release callback to perform the first free
4. Execute the vfree on the dangling pointer to corrupt kernel heap
5. Leverage resulting use-after-free for memory control or denial of service

How to detect it

Review kernel logs for double-free or use-after-free warnings referencing stm_device_release; inspect module load sequences and device registration events around crash times.

What your security team should do

• Prioritize kernel upgrades on all systems exposing stm devices or using affected stable trees
• Monitor EPSS and KEV status for any future increase in exploit activity
• Apply the fix during the next maintenance window given the 844 days since disclosure