CVE-2024-47749

What it actually does

Missing NULL check on lookup_atid() return value allows null pointer dereference in act_establish() and act_open_rpl() within the cxgb4 RDMA driver.

Why it matters to the business

Systems using Chelsio T4/T5 RDMA hardware may experience kernel panics or crashes, leading to service disruption and potential data loss on affected Linux servers.

How an attack unfolds

An attacker with local access or the ability to influence RDMA connection establishment supplies an invalid ATID, causing lookup_atid() to return NULL; the subsequent dereference in the reply handlers triggers a kernel fault.

How to fix it

Update the Linux kernel to a version containing commit b12e25d91c7f97958341538c7dc63ee49d01548f or apply the equivalent stable patch; for Rocky Linux 8 systems also ensure gettext is at 0.19.8.1-17.el8 or later.

How to confirm the fix worked

Verify the running kernel contains the fix commit, confirm lookup_atid() callers now check for NULL, and test RDMA connection establishment paths under invalid ATID conditions.

Typical attack path

1. Obtain local execution or RDMA control on target system
2. Trigger RDMA active open or establish operations with crafted or invalid ATID values
3. Force lookup_atid() to return NULL
4. Execute the unchecked pointer dereference to crash the kernel

How to detect it

Search kernel logs for oops traces referencing act_establish, act_open_rpl, or lookup_atid; inspect crash dumps for null dereference in cxgb4 RDMA paths.

What your security team should do

• Prioritize kernel updates on all systems exposing cxgb4 RDMA interfaces
• Review and restrict untrusted local access to RDMA-capable hosts
• Monitor for kernel oops or panic events involving cxgb4 functions