CVE-2024-42069

What it actually does

Double free of a kernel memory object (madev) occurs in the mana network driver when auxiliary_device_add fails and the release callback already frees the object, followed by a redundant kfree in the error path.

Why it matters to the business

Local users or processes on affected Linux systems can trigger kernel memory corruption, leading to crashes, denial of service, or potential privilege escalation that disrupts operations and requires system restarts.

How an attack unfolds

An attacker with local access crafts conditions that cause auxiliary_device_add to fail during mana device initialization, allowing the double-free path to execute and corrupt kernel heap memory for denial of service or further exploitation.

How to fix it

Apply the upstream fix by updating the Linux kernel to include commit c9c3395d5e3dcc6daee66c6908354d47bf98cb0c or later; rebuild and deploy the kernel image, then reboot affected systems.

How to confirm the fix worked

Verify the presence of commit c9c3395d5e3dcc6daee66c6908354d47bf98cb0c in the kernel source tree or confirm the patched version string after rebuild; test mana device initialization under error conditions to ensure no double-free occurs.

Typical attack path

1. Obtain local access to a system running an unpatched Linux kernel with the mana driver enabled
2. Trigger error conditions during auxiliary device registration in the mana driver
3. Cause the error handling path to execute the redundant kfree after the release callback has already freed the object
4. Exploit resulting memory corruption for crash or escalation

How to detect it

Review kernel logs for oops or panic messages referencing double-free or kfree in the mana or auxiliary device paths; inspect dmesg and syslog for error handling around auxiliary_device_add failures.

What your security team should do

• Prioritize kernel updates containing the referenced commit on all systems using the mana driver
• Monitor for local privilege escalation attempts on unpatched hosts
• Restrict local access where possible until patches are applied