CVE-2024-42091

What it actually does

Null pointer dereference in drm/xe PAT debugfs dumping when pat.ops is unset (valid on VF or new platforms), leading to kernel crash on access.

Why it matters to the business

Potential denial of service via system crashes when debugfs PAT settings are read on affected kernel configurations, increasing operational disruption risk in virtualized or future hardware deployments.

How an attack unfolds

An attacker with debugfs access triggers the PAT settings dump path in drm/xe; absence of pat.ops check causes immediate null dereference and kernel panic.

How to fix it

Upgrade the Linux kernel to a version containing commit 583ce246c7ff9edeb0de49130cdc3d45db8545cb which adds the pat.ops pointer check before dumping.

How to confirm the fix worked

Confirm presence of the pat.ops NULL check in drm/xe debugfs code or verify kernel version includes the referenced commit; test debugfs access on VF or simulated new platform configurations.

Typical attack path

1. Obtain access to debugfs interface on target system
2. Navigate to or trigger drm/xe PAT settings dump entry
3. Trigger read operation on the debugfs file
4. Cause null pointer dereference and kernel oops/panic

How to detect it

Review kernel logs for oops/panic traces mentioning drm/xe, pat.ops, or PAT debugfs dumping; search system logs for null dereference faults in the xe driver module.

• drm/xe.*pat.ops
• xe_pat.*dump
• NULL pointer dereference.*xe

What your security team should do

• Prioritize kernel upgrade to the fixed commit across all affected systems
• Restrict debugfs access to privileged users only until patched
• Monitor for kernel crashes related to drm/xe PAT handling