CVE-2024-43888

What it actually does

Use-after-free in Linux kernel list_lru due to missing RCU read lock around mem_cgroup_from_slab_obj(), allowing a freed memory cgroup pointer to be dereferenced.

Why it matters to the business

Kernel instability or crashes on Linux systems can disrupt services, increase downtime, and create opportunities for local privilege escalation in multi-tenant or containerized environments.

How an attack unfolds

An attacker with local access manipulates memory cgroup and slab operations to race with the unlocked mem_cgroup_from_slab_obj() call, dereferencing a freed structure and triggering undefined behavior that may be turned into code execution.

How to fix it

Apply the upstream fix in commit 4589f77c18dd98b65f45617b6d1e95313cf6fcab or upgrade to a kernel release containing this commit; rebuild and deploy updated kernel packages across all affected systems.

How to confirm the fix worked

Confirm the patch is present in the running kernel source or package; boot test kernels with the fix and verify absence of the prior locking omission in list_lru code paths.

Typical attack path

1. Obtain local access on a vulnerable Linux kernel
2. Create or manipulate memory cgroups and trigger slab allocations
3. Race the unlocked mem_cgroup_from_slab_obj() path
4. Dereference the freed cgroup pointer to cause crash or gain execution

How to detect it

Review kernel logs and dmesg for use-after-free warnings or oops involving list_lru and mem_cgroup; correlate with audit records of cgroup creation or slab activity around crash times.

What your security team should do

• Prioritize kernel updates containing commit 4589f77c18dd98b65f45617b6d1e95313cf6fcab on all production systems
• Test patched kernels in staging before broad rollout
• Enable kernel hardening features such as lockdown and restrict unprivileged cgroup access until patched