CVE-2024-39282

What it actually does

Race condition in mtk_t7xx WWAN driver FSM command handling allows main thread to release completion object while async thread still references it, resulting in use-after-free and page fault during complete_all.

Why it matters to the business

Kernel panics on affected Linux systems using the t7xx modem driver can cause unexpected reboots and loss of WWAN connectivity; low EPSS indicates limited remote exploit risk but still necessitates patching to maintain stability.

How an attack unfolds

An attacker triggers an internal FSM state change command that times out; the main thread releases the completion while the async thread attempts notification, crashing the kernel. No active threat actors or ransomware usage reported.

How to fix it

Update Linux kernel to include commit b8ab9bd0c8855cd5a6f4e0265083576257ff3fc5 or equivalent fixed version from stable tree.

How to confirm the fix worked

Verify kernel source contains the reference-counter fix for fsm_main_thread; test FSM command paths under timeout conditions to confirm no panic occurs.

Typical attack path

1. Trigger internal FSM state change command in t7xx driver
2. Force timeout detection in main thread
3. Async thread executes invalid completion notification on freed object

How to detect it

Search kernel logs and crash dumps for oops involving complete_all called from fsm_main_thread in the mtk_t7xx module and page fault at address fffffffffffffff8.

What your security team should do

• Apply the referenced kernel commit to all affected systems
• Prioritize updates on devices with t7xx WWAN hardware
• Monitor kernel logs for mtk_t7xx related oops after deployment