CVE-2024-43850

What it actually does

Refcount imbalance in the OPP table during bwmon_remove in the Qualcomm icc-bwmon driver, causing _opp_table_kref_release warnings on module unload due to failure to release OPPs after use.

Why it matters to the business

Kernel warnings and potential stability issues during driver unload on Qualcomm-based Linux systems; high ecosystem prevalence across 455 downstream dependents increases exposure in embedded and mobile deployments, though low EPSS and no KEV status indicate limited active risk.

How an attack unfolds

An attacker with local access unloads the icc_bwmon module to trigger bwmon_remove, surfacing the refcount imbalance warning in the OPP core; no remote or unauthenticated exploitation path exists and no threat actors are associated.

How to fix it

Update the Linux kernel to include commit aad41f4c169bcb800ae88123799bdf8cdec3d366 or equivalent fixed versions that release OPPs after use in icc-bwmon; apply stable tree updates promptly given the 786 days since publication.

How to confirm the fix worked

Verify the presence of the fix commit in the kernel source; unload the icc_bwmon module and confirm absence of the _opp_table_kref_release warning in dmesg or kernel logs.

Typical attack path

1. Obtain local access to the target system
2. Unload the icc_bwmon kernel module via rmmod or modprobe -r
3. Trigger device unbind and driver cleanup routines
4. Observe refcount warning in kernel logs during _opp_table_kref_release

How to detect it

Search kernel logs and dmesg for traces containing _opp_table_kref_release, dev_pm_opp_remove_table, bwmon_driver_exit, and the associated call stack from device_unbind_cleanup.

• WARNING: at drivers/opp/core.c:1640 _opp_table_kref_release+0x150/0x158
• bwmon_driver_exit+0x18/0x524 [icc_bwmon]
• devm_pm_opp_of_table_release+0x10/0x1c
• Hardware name: Qualcomm Technologies, Inc. X1E80100 CRD (DT)

What your security team should do

• Apply the referenced kernel commit or newer stable release containing the OPP release fix
• Monitor kernel logs on Qualcomm platforms for the specific OPP refcount warning during module operations
• Prioritize updates on devices using icc-bwmon such as X1E80100 CRD due to ecosystem prevalence