CVE-2024-46739

What it actually does

The vulnerability is a NULL pointer dereference in hv_uio_rescind for primary VM Bus channels because primary_channel is always NULL on primary channels while the rescind callback assumes it is valid; the fix retrieves device_obj from the parent instead.

Why it matters to the business

Kernel crashes or denial of service on Linux systems using Hyper-V UIO drivers can disrupt virtualized workloads, increase operational overhead for reboots and investigations, and affect organizations running affected kernels in cloud or enterprise environments.

How an attack unfolds

An attacker triggers a rescind callback on a primary VM Bus channel, causing the kernel to follow the always-NULL primary_channel pointer and crash; listed threat actor campaigns reference similar kernel memory issues but no public weaponization of this specific flaw is confirmed.

How to fix it

Apply the upstream fix (commit 3d414b64ecf6fd717d7510ffb893c6f23acbf50e) or upgrade to a patched kernel branch; for github.com/juju/juju update to 3.0.3 or 2.9.38.

How to confirm the fix worked

Confirm the patch is present by inspecting the hv_uio_rescind function for the parent-based device_obj retrieval, verify kernel version contains the fix, and test primary-channel rescind paths under load.

Typical attack path

1. Gain local access or control a workload that can interact with Hyper-V VM Bus channels
2. Trigger a channel rescind operation on a primary channel
3. Force the hv_uio_rescind handler to dereference the NULL primary_channel pointer
4. Induce kernel panic or oops

How to detect it

Inspect kernel logs for oops or panic messages containing hv_uio_rescind, uio_hv_generic, or NULL pointer dereference during channel rescind events; correlate with Hyper-V VM Bus activity.

What your security team should do

• Patch Linux kernels to the fixed commit or later stable releases immediately
• Prioritize systems exposed to Hyper-V or uio_hv_generic workloads
• Monitor for kernel panics referencing uio_hv_generic
• Review downstream dependents such as juju deployments for coordinated upgrades