CVE-2024-39485

What it actually does

Failure to call list_del_init() on notifier_entry after unregister leaves dangling list pointers that can be dereferenced during subsequent notifier operations, resulting in memory corruption within the V4L async subsystem.

Why it matters to the business

Systems relying on video capture or media devices may experience kernel instability or crashes, leading to service disruption on Linux-based platforms including embedded and Android-derived kernels until patched.

How an attack unfolds

An attacker with local access triggers repeated register/unregister sequences on a V4L notifier to leave dangling pointers, then crafts subsequent operations that dereference the stale list entries to corrupt kernel memory and induce denial of service.

How to fix it

Update the Linux kernel to a version containing commit 87100b09246202a91fce4a1562955c32229173bb which replaces list_del with list_del_init on the notifier_entry.

How to confirm the fix worked

Verify the presence of list_del_init() on notifier_entry in media/v4l2-async.c and confirm the running kernel is built from a tree that includes the referenced commit hash.

Typical attack path

1. Obtain local code execution on an affected Linux kernel
2. Load or interact with a V4L device driver that uses async notifiers
3. Trigger notifier registration followed by unregister without proper re-initialization
4. Perform follow-on operations that walk the corrupted notifier list
5. Cause kernel panic or memory corruption resulting in availability impact

How to detect it

Review kernel logs for list corruption warnings, use-after-free traces, or V4L async notifier panics; correlate with processes that interact with /dev/video* nodes around the time of the event.

What your security team should do

• Apply the kernel update containing commit 87100b09246202a91fce4a1562955c32229173bb at the earliest maintenance window
• Monitor for V4L-related kernel oops or list corruption warnings in dmesg
• Restrict unprivileged local access on systems exposing V4L interfaces until patched