CVE-2024-40991

What it actually does

The of_k3_udma_glue_parse_chn_by_id helper decrements the reference count of a device-tree node via of_node_put without a prior increment, causing premature release and subsequent use-after-free of the node object.

Why it matters to the business

Systems using TI K3 DMA engines may experience kernel instability or crashes during device initialization, increasing downtime risk for embedded and networking workloads that depend on stable DMA paths.

How an attack unfolds

An attacker with the ability to load or configure a device tree that triggers of_k3_udma_glue_parse_chn_by_id can cause the node to be freed while still referenced, leading to a use-after-free that may be leveraged for kernel memory corruption or denial of service.

How to fix it

Upgrade the Linux kernel to version 6.9.7 or later, or apply the fix from commit a5ab5f413d1e4c7ed5f64271b025f0726374509e in the stable repository.

How to confirm the fix worked

Confirm the running kernel contains commit a5ab5f413d1e4c7ed5f64271b025f0726374509e or is at least version 6.9.7; inspect the source of of_k3_udma_glue_parse_chn_by_id to verify the reference count is managed correctly.

Typical attack path

1. Craft or modify device tree to invoke the affected parse function
2. Trigger DMA channel allocation that calls of_k3_udma_glue_parse_chn_by_id
3. Force the erroneous of_node_put to drop the last reference
4. Reuse or access the now-freed device node object to corrupt kernel memory

How to detect it

Review kernel logs for oops or warning messages referencing of_node_put or k3-udma-glue around device-probe time; correlate with device-tree nodes that declare udmax_np properties.

• k3-udma-glue
• of_k3_udma_glue_parse_chn_by_id
• of_node_put

What your security team should do

• Apply the kernel update to 6.9.7 or equivalent fixed commit as highest priority on all affected TI K3 platforms
• Monitor vendor advisories for backported patches in supported LTS branches
• Test DMA functionality after upgrade to ensure channel initialization succeeds without reference-count warnings