CVE-2024-39493

What it actually does

Use-after-free in the Linux kernel QAT crypto driver ADF_DEV_RESET_SYNC handling due to incorrect completion_done checks allowing a caller to exit before wait_for_completion or after cancel, leaving dangling references to freed memory.

Why it matters to the business

Local users on affected Linux systems can trigger kernel crashes or instability, leading to denial of service on servers or devices using Intel QAT hardware; widespread kernel deployments increase exposure across cloud, enterprise, and embedded environments.

How an attack unfolds

An attacker with local access triggers the QAT device reset path, races the completion and wait logic to cause a use-after-free, then leverages the resulting kernel memory corruption for denial of service; no public in-the-wild exploitation or ransomware use reported.

How to fix it

Upgrade the Linux kernel to a fixed version such as 4.19.316 or apply commit 0ce5964b82f212f4df6a9813f09a0b5de15bd9c8; rebuild and reboot systems using the patched kernel; disable QAT if hardware is unused as a temporary mitigation.

How to confirm the fix worked

Confirm the running kernel version is at or above the listed fixed releases; inspect dmesg or kernel logs for absence of the original completion_done warnings after applying the patch; verify the git commit is present in the kernel source tree.

Typical attack path

1. Obtain local shell or user access on a system with QAT-enabled kernel
2. Trigger ADF_DEV_RESET_SYNC via crypto or device reset operations
3. Race completion_done versus wait_for_completion to hit UAF
4. Cause kernel panic or oops resulting in denial of service

How to detect it

Review kernel logs and dmesg for QAT reset-related warnings or crashes; look for processes triggering crypto device resets in audit logs; no specific post-exploitation artifacts are publicly documented.

What your security team should do

• Prioritize kernel updates on all systems exposing QAT hardware within standard patch cycles
• Audit kernel configurations to identify QAT usage and limit local access where possible
• Monitor upstream stable kernel releases for backports to older LTS branches