CVE-2024-44978

What it actually does

Use-after-free in Linux kernel DRM/XE driver: job object freed after xe_exec_queue_put can destroy the associated VM, leaving a dangling reference to invalid memory.

Why it matters to the business

Local attackers may crash systems or escalate privileges on machines running affected kernels, leading to downtime, data corruption, or full host compromise in graphics-heavy workloads.

How an attack unfolds

An attacker with local access triggers DRM job submission paths that hold a job reference dependent on a VM; after the final xe_exec_queue_put destroys the VM, the job is freed and later dereferenced, resulting in UAF.

How to fix it

Upgrade to a kernel containing commit 98aa0330f200b9b8fb9e1298e006eda57a13351c or later; apply the corresponding stable backports for each maintained branch.

How to confirm the fix worked

Confirm the presence of the fix commit in the running kernel source tree; test job submission and queue teardown paths under memory pressure to verify absence of UAF.

Typical attack path

1. Gain local user access on target host
2. Invoke sequences of DRM/XE exec queue and job operations
3. Trigger VM destruction via final queue put while job still references VM
4. Dereference freed job memory to achieve UAF

How to detect it

Inspect kernel logs (dmesg, journalctl) for oops/panic messages referencing xe_exec_queue_put or job VM references around the time of crashes; correlate with process activity using DRM interfaces.

What your security team should do

• Prioritize kernel updates on all systems exposing DRM/XE interfaces
• Restrict unprivileged local access until patches are deployed
• Review logs for drm/xe related oops after patching