CVE-2024-44980

What it actually does

Memory leak of unreferenced opregion object (192 bytes) allocated during intel_opregion_setup called from xe_display_init_noirq and xe_device_probe in the drm/xe driver, with no corresponding release on module load or device probe failure paths.

Why it matters to the business

Gradual kernel memory exhaustion on systems with Intel Xe graphics hardware after repeated module loads or boots, potentially causing performance degradation, OOM kills, or instability in long-running environments; low urgency due to absent KEV listing, stable low EPSS, and no known threat actor exploitation despite widespread Linux kernel use.

How an attack unfolds

An attacker with local access loads the xe driver via modprobe or triggers PCI device probe to allocate the opregion without cleanup, repeating the action across reboots or containerized workloads to deplete memory; no remote vector or code execution path exists.

How to fix it

Update the Linux kernel to a version containing commit f7ecdd9853dd9f34e7cdfdadfb70b8f40644ebb4 or later; for Nomad environments also upgrade to 1.5.6 or 1.4.11; rebuild and reboot with the patched kernel; enable CONFIG_DEBUG_KMEMLEAK if not already active for ongoing leak detection.

How to confirm the fix worked

Verify kernel source contains the fix commit or check dmesg / kmemleak reports for absence of the 0xffff8881a0300008 opregion object after xe module load; confirm package versions match fixed entries for org/pub/scm/linux/kernel/git/stable/linux.git and github.com/hashicorp/nomad.

Typical attack path

1. Obtain local shell or container access on affected Linux system
2. Trigger xe PCI device probe or modprobe xe module load
3. Repeat driver attachment across multiple boots or isolated environments
4. Monitor for unreferenced kmemleak objects growing over time

How to detect it

Scan kernel logs and kmemleak reports for the backtrace containing intel_opregion_setup, xe_display_init_noirq, and xe_pci_probe; search dmesg or syslog for modprobe pid entries allocating 192-byte objects from the xe module; review system boot logs for repeated unreferenced object warnings.

• unreferenced object 0xffff8881a0300008
• intel_opregion_setup+0x89/0x700 [xe]
• xe_display_init_noirq+0x2f/0x90 [xe]
• xe_pci_probe+0x333/0x5b0 [xe]
• comm "modprobe", pid

What your security team should do

• Apply kernel and Nomad updates to fixed versions within standard change windows given low EPSS and no KEV status
• Enable kmemleak and monitor for opregion allocations during driver initialization
• Restrict local module loading via kernel module signing and least-privilege containers
• Include the backtrace functions in periodic memory-leak audits