CVE-2024-43832

What it actually does

Use-after-free in s390/uv folio handling: folio_wait_writeback() is invoked after PTL drop without a folio reference, allowing concurrent free of the folio object.

Why it matters to the business

Kernel instability or potential privilege escalation on s390 Linux systems; 349 downstream dependents increase exposure surface across dependent packages and distributions.

How an attack unfolds

An attacker with local access triggers the s390 UV code path that drops the PTL then calls folio_wait_writeback on a potentially freed folio; listed threat actors have targeted similar Linux kernel use-of-uninitialized-resource and out-of-bounds write issues in 2024 campaigns.

How to fix it

Update to a fixed kernel containing the referenced commit; for pymongo (PyPI) environments listed as affected, upgrade to version 4.6.3.

How to confirm the fix worked

Confirm kernel source contains the fix preventing folio_wait_writeback without reference; verify pymongo package version is 4.6.3 or later via package manager.

Typical attack path

1. Obtain local code execution on s390 Linux host
2. Trigger memory pressure or concurrent folio operations to race the PTL drop
3. Invoke the vulnerable uv code path that calls folio_wait_writeback without reference
4. Access freed folio to achieve use-after-free primitive
5. Escalate to kernel code execution or denial of service

How to detect it

Review kernel logs for folio-related oops or warnings around s390 UV code; search process execution history for local exploit attempts against kernel memory management; correlate with threat actor TTPs for Linux kernel resource misuse.

What your security team should do

• Prioritize patching s390 Linux kernels within 30 days given published date and ecosystem reach
• Audit s390 systems for the vulnerable folio_wait_writeback call pattern
• Upgrade pymongo to 4.6.3 where present in dependency trees
• Monitor EPSS trend for any increase above 0.01