CVE-2024-39479

What it actually does

Use-after-free in the i915 hwmon driver caused by non-deterministic release order of devm-managed hwmon and drvdata resources during device unbind, allowing sysfs access after drvdata has been freed.

Why it matters to the business

Local attackers on affected Linux systems can trigger kernel crashes or arbitrary code execution, resulting in denial of service, privilege escalation, or full system compromise; high prevalence in Linux distributions increases exposure across servers, desktops, and embedded devices.

How an attack unfolds

An attacker with local access triggers i915 device unbind paths (such as component_del or device_release_driver_internal) that release drvdata before hwmon; subsequent access to hwmon sysfs entries then dereferences the freed drvdata, leading to use-after-free. Threat actor references to Android kernel RCE techniques indicate similar local kernel exploitation patterns may be adapted.

How to fix it

Update the Linux kernel to the fixed commit cfa73607eb21a4ce1d6294a2c5733628897b48a2 or later equivalent stable release; remove reliance on devm for hwmon registration and explicitly manage resource lifetime during unbind.

How to confirm the fix worked

Verify the running kernel contains commit cfa73607eb21a4ce1d6294a2c5733628897b48a2; confirm hwmon and drvdata release order is now deterministic by reviewing i915_hwmon_register and fini paths; test device unbind under load to ensure no UAF warnings appear in dmesg.

Typical attack path

1. Obtain local user access on a system using the vulnerable i915 driver
2. Trigger device unbind or driver removal via unbind_store or pci_device_remove
3. Force the code path that frees drvdata before hwmon via component_unbind_all or device_unbind_cleanup
4. Access hwmon sysfs attributes to trigger dereference of the freed memory
5. Leverage the resulting use-after-free for crash, information leak, or code execution

How to detect it

Review kernel logs for call traces involving release_nodes, devres_release_group, component_unbind_all, intel_pxp_tee_component_fini, and i915_driver_remove; look for use-after-free warnings or oops referencing hwmon sysfs access after driver removal.

What your security team should do

• Immediately upgrade all affected Linux kernels to the fixed commit version
• Prioritize systems with i915 hardware and direct user access
• Monitor for kernel oops or warnings related to i915 hwmon during driver unload
• Apply defense-in-depth such as disabling unnecessary i915 features if patching is delayed