CVE-2024-44998

What it actually does

Use-after-free in the idt77252 ATM driver's dequeue_rx function allows dereferencing a released skb after vcc->push() is called.

Why it matters to the business

Kernel instability, crashes, or potential code execution on Linux systems using legacy ATM hardware, increasing downtime and security risk for network infrastructure and dependent services.

How an attack unfolds

An attacker with local access or network conditions triggering ATM receive paths forces the dequeue_rx function to call vcc->push(), which frees the skb, then dereferences the freed pointer leading to memory corruption.

How to fix it

Upgrade the Linux kernel to include commit 628ea82190a678a56d2ec38cda3addf3b3a6248d or apply vendor patches; for Cilium deployments upgrade to version 1.14.8 or 1.15.2.

How to confirm the fix worked

Verify kernel source contains the fix commit, confirm absence of the vulnerable skb dereference after vcc->push(), and test ATM receive paths under load.

Typical attack path

1. Gain local execution or control network traffic reaching the idt77252 ATM device
2. Trigger dequeue_rx path in the ATM driver
3. Cause vcc->push() to release the skb
4. Dereference the freed skb pointer to corrupt kernel memory
5. Escalate to kernel code execution or denial of service

How to detect it

Search kernel logs for oops/panic messages referencing idt77252 or dequeue_rx, and inspect for unexpected skb handling in ATM receive paths.

What your security team should do

• Apply kernel or Cilium updates immediately on systems exposing ATM interfaces
• Disable unused ATM drivers via kernel configuration if not required
• Monitor for kernel oops or panic logs related to atm idt77252
• Review network exposure of legacy ATM hardware