CVE-2024-42065

What it actually does

Missing NULL check in xe_ttm_stolen_mgr_init allows dereference of a NULL pointer, resulting in kernel crash or denial of service.

Why it matters to the business

System instability and potential denial of service on Linux kernels with Intel Xe graphics support, leading to unplanned downtime for affected machines.

How an attack unfolds

A local attacker triggers the stolen memory manager initialization in the Xe DRM driver under conditions where the manager pointer is NULL, causing an immediate dereference and kernel panic.

How to fix it

Update the Linux kernel to include commit cc796a77985d6af75c9362cb2e73dce4ae3f97cd which adds the required NULL check in xe_ttm_stolen_mgr_init.

How to confirm the fix worked

Inspect the xe_ttm_stolen_mgr_init function in the kernel source to confirm the explicit NULL check is present after applying the fix.

Typical attack path

1. Obtain local user access on an affected Linux system
2. Invoke operations that reach xe_ttm_stolen_mgr_init with a NULL manager
3. Trigger NULL pointer dereference resulting in kernel oops or panic

How to detect it

Review kernel logs and oops reports for entries referencing xe_ttm_stolen_mgr_init or drm/xe NULL pointer dereferences around the time of any unexpected crashes.

What your security team should do

• Apply the referenced kernel commit or newer stable release containing the fix as soon as possible
• Monitor kernel logs for drm/xe related NULL pointer dereference events
• Test patched kernels in staging environments before broad deployment