CVE-2024-41087

What it actually does

Double free of the ata_host structure in ata_host_alloc() when ata_port_alloc() fails, because devres_release_group() already invokes ata_host_release() which calls kfree(host) before the explicit kfree in the error path.

Why it matters to the business

Kernel crashes or memory corruption on Linux systems using libata/AHCI storage, risking denial of service or local privilege escalation; widespread Linux kernel deployment amplifies operational disruption and patch urgency across servers and endpoints.

How an attack unfolds

A local attacker triggers an error condition during ata_host_alloc (e.g., resource exhaustion or hardware init failure) to reach the err_out label, causing the double-free; the resulting invalid memory state is then abused for arbitrary writes or use-after-free to elevate privileges, consistent with observed Linux kernel exploitation patterns by espionage and financially motivated actors.

How to fix it

Apply the fix from commit 290073b2b557e4dc21ee74a1e403d9ae79e393a2; upgrade to a kernel containing this commit or a later stable release that removes the redundant kfree in the error path of ata_host_alloc.

How to confirm the fix worked

Verify kernel source or running version contains commit 290073b2b557e4dc21ee74a1e403d9ae79e393a2; recompile and test ata_host_alloc error paths or monitor for absence of the slub.c BUG on kfree.

Typical attack path

1. Gain local access on a Linux system
2. Trigger ata_host_alloc failure path in libata during storage controller initialization
3. Induce double-free via devres and explicit kfree sequence
4. Leverage freed memory for corruption or code execution
5. Escalate to root or kernel-level control

How to detect it

Search kernel logs and crash dumps for the double-free BUG in slub.c triggered from ata_host_alloc during ahci or udev initialization; correlate with process traces showing libata error paths.

• kernel BUG at mm/slub.c:553
• ata_host_alloc+0xf5/0x120 [libata]
• RIP: 0010:kfree+0x2cf/0x2f0
• Oops: invalid opcode: 0000 [#1] PREEMPT SMP NOPTI
• Call Trace: ata_host_alloc+0xf5/0x120 [libata]

What your security team should do

• Immediately update all Linux kernels to versions containing commit 290073b2b557e4dc21ee74a1e403d9ae79e393a2
• Restrict unprivileged local access on systems exposing storage drivers
• Monitor kernel logs for libata-related oops during device enumeration
• Prioritize patching on high-value or internet-facing Linux hosts