CVE-2024-46683

What it actually does

Use-after-free in the drm/xe driver where the preempt fence lock resides in the queue; signaling the fence and dropping the queue reference allows a waiter to later acquire a now-freed lock, resulting in arbitrary kernel memory access.

Why it matters to the business

Local attackers on affected Linux systems can crash the kernel or escalate privileges, leading to denial of service, data exposure, or full host compromise; high prevalence in Linux distributions increases exposure for servers and workstations using Xe graphics.

How an attack unfolds

An attacker with local access crafts GPU queue operations that trigger fence signaling followed by queue release; a concurrent waiter wakes, acquires the now-freed fence lock, and performs memory operations on the dangling structure, enabling code execution or kernel panic.

How to fix it

Upgrade the Linux kernel to a version containing commit 10081b0b0ed201f53e24bd92deb2e0f3c3e713d4 or later; rebuild and reboot all affected systems; if immediate patching is not possible, restrict untrusted local accounts and disable Xe graphics where feasible.

How to confirm the fix worked

Confirm the running kernel contains commit 10081b0b0ed201f53e24bd92deb2e0f3c3e713d4 via 'uname -r' and git log; test fence lifetime paths with the upstream regression test suite; monitor for kernel oops referencing xe preempt fence structures.

Typical attack path

1. Obtain local user access on a system running an affected kernel with Xe graphics enabled
2. Trigger creation and signaling of a preempt fence while holding minimal references
3. Release the queue reference immediately after signaling
4. Race with a waiter that wakes later and acquires the fence lock
5. Perform read/write operations on the freed lock memory to corrupt kernel state

How to detect it

Search kernel logs for oops or warning messages referencing xe fence, preempt fence, or UAF around queue release; examine crash dumps for freed queue structures being accessed after the final reference drop; no public exploit artifacts are known.

What your security team should do

• Prioritize kernel updates on all systems exposing local user access within the next 30 days
• Audit workloads that rely on Xe graphics hardware acceleration for privilege separation
• Enable kernel hardening features such as CONFIG_SLAB_FREELIST_RANDOM and lockdown mode
• Add kernel oops and fence-related symbols to SIEM alerting rules