CVE-2024-39292

What it actually does

Race condition in User Mode Linux winch IRQ registration allows an interrupt to occur before the handler is added to the winch_handlers list, resulting in a use-after-free that triggers a kernel panic during winch_cleanup.

Why it matters to the business

Local users on affected Linux systems can trigger system crashes leading to denial of service, with potential disruption to workloads running on User Mode Linux instances; the issue is local-only and has low exploitation probability.

How an attack unfolds

An attacker with local access triggers a winch IRQ before register_winch_irq completes adding the handler to the list; the kernel then schedules a freed winch for cleanup, causing a panic. No named threat actors have been observed exploiting this race.

How to fix it

Update the Linux kernel to commit bbf25010f1a6b761914430f5fca081ec8c7accd1 or later; rebuild and deploy the fixed kernel image across all affected hosts.

How to confirm the fix worked

Confirm the running kernel contains commit bbf25010f1a6b761914430f5fca081ec8c7accd1 via git log or kernel version string; attempt to reproduce the race under load to verify absence of panic.

Typical attack path

1. Obtain local shell access on a system running the vulnerable Linux kernel with User Mode Linux enabled
2. Trigger winch IRQ registration path while racing against an interrupt
3. Cause the kernel to add a scheduled-for-free winch to the handlers list
4. Induce winch_cleanup to dereference the invalid pointer and panic

How to detect it

Inspect kernel logs for panics mentioning winch_cleanup or winch_handlers; correlate with processes performing UML winch operations around the time of crash.

What your security team should do

• Prioritize patching User Mode Linux hosts within standard change windows due to local DoS impact
• Review systems for UML usage and schedule kernel upgrades to the fixed commit
• Monitor for kernel panics referencing winch_cleanup after patching