CVE-2024-49570

What it actually does

Use-after-free in the xe_bo_move trace event caused by dereferencing the xe_mem_type_to_name[] array at TP_printk evaluation time rather than capture time.

Why it matters to the business

Kernel instability, potential local privilege escalation, or system crashes on affected Linux distributions using Xe graphics drivers; low EPSS and no KEV status indicate limited immediate widespread risk but still requires patching on servers and workstations.

How an attack unfolds

An attacker with local access triggers the xe_bo_move tracepoint under conditions where the referenced memory has already been freed; the TP_printk format then dereferences stale data, allowing controlled memory corruption or information disclosure.

How to fix it

Update the Linux kernel to commit 62cd174616ae3bf8a6cf468718f1ae74e5a07727 or later; for kernels older than 6.10, apply the explicit backport of the fix that avoids dereferencing xe_mem_type_to_name[] inside TP_printk.

How to confirm the fix worked

Confirm the patch is present by checking for the updated trace event definition that stores the string value at event record time; verify no reference to xe_mem_type_to_name[] remains inside the TP_printk format string.

Typical attack path

1. Obtain local code execution on a system running a vulnerable kernel with Xe driver tracing enabled
2. Force repeated BO moves while simultaneously freeing the associated memory objects
3. Trigger the trace event so that TP_printk evaluates the now-freed string pointer
4. Leverage the resulting UAF for kernel memory corruption or info leak to escalate privileges

How to detect it

Review kernel logs and ftrace output for oops or warnings referencing xe_bo_move or TP_printk around memory management functions; correlate with process activity that performs frequent buffer object moves.

What your security team should do

• Prioritize kernel updates on all systems exposing Xe graphics tracing
• Disable unnecessary tracepoints in production until patched
• Monitor for kernel oops or crashes involving drm/xe trace events as a temporary detection signal
• Include the fixed commit hash in SBOM and vulnerability scanning rules