CVE-2024-46705

What it actually does

Failure to reset MMIO mappings to NULL after device removal leaves stale pointers that can reference memory regions remapped by other entities, enabling use-after-free access to hardware registers in the drm/xe driver.

Why it matters to the business

Systems using affected Linux kernel versions may experience graphics driver instability, unexpected crashes, or memory corruption that disrupts operations and requires emergency patching, with higher urgency for organizations running large fleets of Intel Xe-based hardware.

How an attack unfolds

An attacker with local access triggers device removal or hot-unplug events for the graphics device, then issues subsequent MMIO operations that hit a now-remapped address space, potentially causing kernel-level memory corruption or information disclosure.

How to fix it

Update the Linux kernel to commit b1c9fbed3884d3883021d699c7cdf5253a65543a or later; for go-ethereum update to version 1.10.17 or newer. Reboot systems after applying the kernel update and verify the patch is active via kernel logs.

How to confirm the fix worked

Confirm the fixed commit is present in the running kernel source or package, then exercise device removal paths while monitoring for NULL dereference warnings or MMIO access errors in dmesg.

Typical attack path

1. Obtain local code execution on target system
2. Trigger drm/xe device removal or unload sequence
3. Perform follow-on MMIO register accesses via userspace or kernel paths
4. Exploit resulting use-after-free to corrupt kernel memory or escalate privileges

How to detect it

Review kernel logs for drm/xe MMIO mapping warnings around device removal events; correlate with process activity that interacts with /dev/dri or graphics sysfs entries.

What your security team should do

• Prioritize patching production kernels within the next maintenance window due to stable but non-zero EPSS
• Scan all Linux distributions for the vulnerable drm/xe driver code
• Enable kernel address space layout randomization and memory protection features as defense-in-depth
• Monitor vendor advisories for backports to older stable kernels