CVE-2024-44979

What it actually does

Missing destroy calls for pagefault and access counter workqueues in the Xe graphics driver leave allocated memory unfreed on driver reload, causing a resource leak in the Linux kernel.

Why it matters to the business

Systems relying on the affected Linux kernel graphics driver may experience gradual memory exhaustion after repeated reloads, leading to degraded performance or instability; low urgency given EPSS of 0.00199, no KEV listing, and no ransomware usage, though the issue affects widely used stable kernel trees.

How an attack unfolds

An attacker with local access could repeatedly trigger driver reloads to amplify the leak, but the flaw is a straightforward omission of cleanup code with no known threat actor exploitation or public proof-of-concept; the fix appears in commit b09ef3b762a7fc641fb2f89afd3ebdb65b8ba1b9.

How to fix it

Upgrade the Linux kernel to a version containing commit b09ef3b762a7fc641fb2f89afd3ebdb65b8ba1b9, which adds the required workqueue destroy calls in xe_gt_pagefault; rebuild and deploy the updated kernel across affected systems.

How to confirm the fix worked

Inspect the xe_gt_pagefault source for the added destroy calls after patching, then perform repeated driver reload tests while tracking memory usage to confirm no leaks occur.

Typical attack path

1. Obtain local access on a system running the vulnerable kernel
2. Trigger multiple Xe driver reload cycles
3. Monitor for increasing memory consumption without corresponding workload growth

How to detect it

Review kernel logs for Xe driver reload events and correlate with unexplained growth in workqueue-related memory allocations; no specific threat actor indicators are known.

What your security team should do

• Apply the fixed kernel commit b09ef3b762a7fc641fb2f89afd3ebdb65b8ba1b9 as soon as possible on systems using Xe graphics
• Include kernel graphics driver updates in standard patching cycles given the 768 days since publication
• Review memory accounting for workqueue objects during driver lifecycle testing