CVE-2024-41149

What it actually does

Use-after-free triggered when a block layer hctx structure is reused without first being removed from the cpuhp callback list.

Why it matters to the business

Potential kernel crashes or local privilege escalation on Linux systems handling block devices, increasing risk of service disruption or compromise on servers and cloud instances.

How an attack unfolds

An attacker triggers repeated hotplug or CPU offline/online events that leave an hctx on the cpuhp list, then reuses the freed structure to corrupt kernel memory and execute arbitrary code.

How to fix it

Upgrade Linux kernel to version 6.12.7 or apply the commit ee18012c80155f6809522804099621070c69ec72 from the stable git tree; rebuild and reboot affected systems.

How to confirm the fix worked

Confirm the patch is present by checking kernel source for the cpuhp removal logic around hctx teardown, then run targeted block device hotplug stress tests to verify no reuse occurs.

Typical attack path

1. Trigger CPU hotplug events to manipulate block device hctx registration
2. Force reuse of an hctx still present in the cpuhp callback list
3. Trigger use-after-free through subsequent block I/O or device operations
4. Leverage freed memory for kernel data corruption or ROP to gain elevated privileges

How to detect it

Review kernel logs for use-after-free warnings or slab corruption messages involving block hctx structures; correlate with CPU hotplug events in dmesg or /var/log/kern.log around the time of crashes.

What your security team should do

• Prioritize kernel upgrades on all production Linux hosts within the next maintenance window
• Monitor upstream stable branches for backports to older LTS kernels still in use
• Restrict unprivileged access to block device hotplug interfaces via SELinux or AppArmor policies