CVE-2024-46698

What it actually does

NULL pointer dereference in sysfb_disable() triggered when a non-VGA primary PCI display device is probed first, causing aperture_detach_platform_device() to free resources that a later VGA-class device then attempts to use inside the mutex-protected path.

Why it matters to the business

Systems with mixed-class display hardware may experience kernel crashes or boot failures, leading to downtime and requiring kernel updates across fleets; prevalence in the Linux kernel ecosystem increases exposure for servers and workstations.

How an attack unfolds

An attacker with the ability to influence boot-time PCI device probing order (for example via firmware configuration or attached hardware) can arrange for a non-VGA primary device to be detached before sysfb_disable() is called on a secondary VGA device, resulting in the dereference.

How to fix it

Update the Linux kernel to commit 17e78f43de0c6da34204cc858b4cc05671ea9acf or later; rebuild and deploy the fixed kernel across all affected distributions and embedded images.

How to confirm the fix worked

Verify the running kernel contains commit 17e78f43de0c6da34204cc858b4cc05671ea9acf, confirm sysfb_disable() now receives and checks a device pointer, and test boot sequences with mixed VGA/non-VGA primary displays.

Typical attack path

1. Configure or attach hardware so a non-VGA PCI display is the primary boot device
2. Trigger kernel initialization of the aperture and sysfb subsystems
3. Allow aperture_remove_conflicting_pci_devices() to call aperture_detach_platform_device() on the primary device
4. Cause a subsequent VGA-class device to invoke sysfb_disable() on already-freed state
5. Trigger NULL dereference and kernel panic

How to detect it

Inspect kernel ring buffer and dmesg logs for NULL pointer dereference oops mentioning sysfb_disable, aperture_remove_conflicting_pci_devices, or pci sysfb_pci_dev_is_enabled; correlate with boot-time device enumeration events.

• sysfb_disable
• aperture_remove_conflicting_pci_devices
• sysfb_pci_dev_is_enabled

What your security team should do

• Prioritize kernel upgrades on systems that may use non-VGA primary displays
• Monitor kernel logs for oops/panic messages referencing sysfb_disable or aperture_remove_conflicting_pci_devices
• Apply the fix within standard patch windows given low EPSS and absence from KEV