CVE-2024-41096

What it actually does

Use-after-free read in PCI/MSI descriptor handling: msi_capability_init accesses a freed msi_desc in the error-exit path after __msi_domain_alloc_locked fails, allowing a read of previously freed kmalloc-128 memory.

Why it matters to the business

Local attackers on affected Linux systems can trigger kernel memory corruption or crashes, leading to denial of service, potential privilege escalation, and unplanned downtime on servers and endpoints running vulnerable kernels.

How an attack unfolds

An attacker with local access triggers pci_alloc_irq_vectors on a PCI device; the allocation path allocates a descriptor, then fails inside msi_domain_alloc_irqs_all_locked; the error path in msi_capability_init dereferences the now-freed descriptor for an unmask operation, producing the UAF read.

How to fix it

Update the Linux kernel to a version containing commit 0ae40b2d0a5de6b045504098e365d4fdff5bbeba or later; apply the stable backport for the running distribution and reboot.

How to confirm the fix worked

Confirm the running kernel contains commit 0ae40b2d0a5de6b045504098e365d4fdff5bbeba via `git log` or package version; recompile with KFENCE enabled and verify the UAF report is no longer triggered on the same failure path.

Typical attack path

1. Obtain local code execution on a system with a vulnerable kernel
2. Open or interact with a PCI device that requests MSI vectors
3. Force allocation failure inside __msi_domain_alloc_locked
4. Trigger the error-exit unmask operation that reads the freed descriptor

How to detect it

Search kernel logs and KFENCE reports for messages containing __pci_enable_msi_range, msi_capability_init, or use-after-free reads at addresses inside kmalloc-128 allocations performed by msi_alloc_desc; correlate with processes calling pci_alloc_irq_vectors.

• BUG: KFENCE: use-after-free read in __pci_enable_msi_range
• msi_domain_free_descs+0xd4/0x10c
• msi_capability_init
• pci_alloc_irq_vectors_affinity+0xec/0x14c

What your security team should do

• Patch all Linux kernels to the fixed commit within the next maintenance window
• Prioritize systems that expose PCI devices to untrusted local users
• Enable KFENCE and lockdep in test kernels to catch similar UAFs early
• Monitor vendor advisories for distribution-specific backports