CVE-2024-46716

What it actually does

Use-after-free in altera-msgdma DMA engine driver due to misplaced list_del in msgdma_chan_desc_cleanup and use of list_add_tail instead of list_move_tail in msgdma_free_descriptor, leaving descriptor nodes on lists during msgdma_free_chan_resources -> msgdma_free_descriptors -> msgdma_free_desc_list path.

Why it matters to the business

Potential kernel crashes, memory corruption, or local privilege escalation on Linux systems with affected Altera/Intel MSG DMA hardware; high prevalence in kernel deployments increases operational risk for servers and embedded devices.

How an attack unfolds

Local attacker allocates and frees DMA channel resources to hit the flawed descriptor cleanup path, causing descriptors to remain referenced after free; subsequent reuse leads to memory corruption exploitable for code execution or denial of service.

How to fix it

Update Linux kernel to commit a3480e59fdbe5585d2d1eff0bed7671583acf725 or later stable releases; rebuild and reboot with patched kernel; for buildkit users upgrade to 0.12.5 or newer.

How to confirm the fix worked

Verify kernel source contains the corrected list_move_tail and removal of erroneous list_del; boot patched kernel and exercise DMA workloads to confirm absence of descriptor list corruption warnings.

Typical attack path

1. Obtain local access on affected Linux system
2. Trigger DMA channel allocation via msgdma driver
3. Invoke msgdma_free_chan_resources to exercise broken free path
4. Reuse freed descriptor memory for corruption or control flow hijack

How to detect it

Review kernel logs and dmesg for oops, warnings, or stack traces mentioning msgdma_free_descriptor, msgdma_chan_desc_cleanup, or list corruption in DMA paths; correlate with process activity triggering DMA channels.

• msgdma_free_descriptor
• msgdma_chan_desc_cleanup
• list_del called from msgdma context
• DMA descriptor list corruption warnings

What your security team should do

• Prioritize kernel updates on all systems exposing DMA hardware
• Harden local access controls to reduce attack surface
• Monitor kernel logs for msgdma-related oops or warnings