CVE-2024-42112

What it actually does

Use-after-free in the txgbe network driver where isb memory is read after free during shared MSI/INTx interrupt handling in the device remove path before IRQs are freed.

Why it matters to the business

Kernel memory corruption on affected Linux systems can cause crashes, instability, or local privilege escalation, leading to downtime and potential full system compromise on servers and endpoints using the driver.

How an attack unfolds

A local attacker triggers the txgbe device remove routine (module unload or hot-unplug) while interrupts remain active; the handler then accesses already-freed isb resources, enabling memory corruption that can be turned into code execution.

How to fix it

Upgrade the Linux kernel to a version containing commit a38297e3fb012ddfa7ce0321a7e5a8daeb1872b6, which moves wx_free_isb_resources() into txgbe_remove() and corrects the error path in txgbe_open().

How to confirm the fix worked

Confirm the running kernel source or binary contains the referenced commit; test by loading/unloading the driver under MSI/INTx interrupt mode and verify no use-after-free warnings occur in dmesg.

Typical attack path

1. Obtain local shell or user access on the target Linux system
2. Unload the txgbe module or trigger device removal while interrupts are enabled
3. Trigger the use-after-free in the interrupt handler during the remove sequence
4. Leverage the resulting memory corruption for privilege escalation or denial of service

How to detect it

Inspect kernel logs (dmesg, /var/log/kern.log) for use-after-free warnings, slab corruption reports, or oops traces referencing txgbe_remove, wx_free_isb_resources, or isb memory during module unload or device removal.

What your security team should do

• Prioritize kernel upgrade to the fixed commit on all systems exposing the txgbe driver
• Restrict unprivileged local access until patches are applied
• Enable kernel hardening features such as KASAN or hardened usercopy where feasible
• Monitor kernel logs for txgbe-related oops or slab corruption messages