CVE-2024-42139

What it actually does

Use-after-free in the Linux kernel PTP subsystem where an extts event remains enabled after driver removal while ts2phc runs, allowing the freed event to trigger a kernel crash on subsequent operations or reload.

Why it matters to the business

Unpatched systems risk kernel crashes and reboots during driver unload/reload cycles, leading to unplanned downtime for time-sensitive or PTP-dependent workloads; low exploitability reduces immediate ransomware risk but still requires prompt patching due to widespread kernel exposure.

How an attack unfolds

An attacker with local access unloads the relevant network driver while the ts2phc application holds an extts event enabled; the dangling event reference later dereferences freed memory during interrupt or reload handling, crashing the kernel. No named threat actors are associated with this issue.

How to fix it

Update the Linux kernel to the fixed commit 9f69b31ae9e25dec27ad31fbc64dd99af16ee3d3 or later stable releases containing the extts disable-on-release change; rebuild and reboot into the patched kernel.

How to confirm the fix worked

Verify the running kernel contains commit 9f69b31ae9e25dec27ad31fbc64dd99af16ee3d3; confirm absence of extts events after driver removal by checking dmesg for related messages and ensuring no crashes occur on unload/reload cycles.

Typical attack path

1. Obtain local code execution or shell on target system
2. Trigger removal of PTP-capable network driver while ts2phc or similar is active
3. Cause extts event to fire against freed context on reload or interrupt
4. Trigger kernel panic or attempt to leverage resulting UAF for further exploitation

How to detect it

Search kernel logs and crash dumps for messages containing "extts on unexpected channel" or references to extts events during driver unload; inspect for use-after-free signatures in PTP-related call stacks.

• extts on unexpected channel
• kernel panic in ptp or extts handling after driver removal
• dangling extts event after module unload

What your security team should do

• Prioritize kernel updates on systems using PTP or ts2phc within the next patching cycle
• Audit for custom or out-of-tree PTP drivers that may reintroduce the same pattern
• Monitor kernel crash reports and dmesg for extts-related panics as a temporary detection measure