CVE-2024-39501

What it actually does

Race condition between really_probe() setting dev->driver to NULL on probe failure and dev_uevent() dereferencing dev->driver->name without sufficient synchronization on all paths, resulting in NULL pointer dereference and kernel crash.

Why it matters to the business

Unexpected system crashes and instability on Linux hosts during device initialization or uevent operations, leading to downtime, service disruption, and potential loss of availability in environments running affected kernels.

How an attack unfolds

An attacker with local access triggers concurrent device probe failures and uevent reads, exploiting the window where dev->driver is cleared without protection on the uevent path to cause a crash; similar races have been observed via fuzzing tools.

How to fix it

Upgrade the Linux kernel to a fixed version such as 5.10.221-1 or later on Debian 11 systems; apply vendor patches that add proper locking around the non-protected dev_uevent path.

How to confirm the fix worked

Verify the installed kernel version is at or above the fixed release, confirm the synchronization patch is present in the source, and test device probe and uevent operations under concurrent load to ensure no crash occurs.

Typical attack path

1. Obtain local access to a system running an affected Linux kernel
2. Trigger device probe operations that fail and invoke device_unbind_cleanup
3. Simultaneously invoke uevent reads via sysfs or related interfaces before synchronization completes
4. Cause NULL dereference in dev_uevent leading to kernel panic or oops

How to detect it

Review kernel logs for oops or panic traces matching the dev_uevent and really_probe stack frames, and search system logs for concurrent device probe failures and uevent activity around crash times.

What your security team should do

• Prioritize kernel upgrades on all Debian 11 systems to the fixed 5.10.221-1 version
• Monitor for kernel oops or panic logs related to dev_uevent and really_probe
• Apply updates promptly given the public disclosure and syzkaller reports
• Restrict unprivileged local access where possible until patched