CVE-2024-49852

What it actually does

Use-after-free in efc_nport_vport_del() where kref_put() invokes _efc_nport_free() to release nport and the subsequent dereference of nport occurs on already-freed memory.

Why it matters to the business

Risk of kernel instability, crashes, or potential privilege escalation on affected Linux systems using the elx libefc SCSI driver; low exploit probability and no known ransomware usage reduce immediate operational disruption.

How an attack unfolds

An attacker with local access triggers the nport vport deletion code path so that the reference count reaches zero; the release callback frees the nport structure, after which the next line dereferences the freed pointer, enabling memory corruption that can be turned into arbitrary code execution.

How to fix it

Apply the kernel patch that reorders the kref_put() call and the subsequent dereference; upgrade affected packages to the listed fixed versions including nokogiri 1.8.2 where applicable.

How to confirm the fix worked

Confirm the reordered code in efc_nport_vport_del() no longer dereferences nport after kref_put(); verify the running kernel version contains the fix and test nport deletion paths under load.

Typical attack path

1. Obtain local access on a system with the vulnerable elx libefc driver loaded
2. Trigger nport vport deletion to drive the reference count to zero
3. Leverage the subsequent use of the freed nport pointer for memory corruption
4. Escalate to kernel-level code execution or denial of service

How to detect it

Inspect kernel logs for oops or panic messages referencing efc_nport_vport_del or _efc_nport_free; correlate with process activity that performs nport or vport deletion operations.

What your security team should do

• Prioritize patching Linux kernel packages containing the elx libefc driver
• Monitor EPSS and threat actor reports for any increase in exploitation activity
• Apply the exact fixed versions provided for dependent packages such as nokogiri 1.8.2
• Review systems for presence of the vulnerable SCSI driver and schedule updates before any future KEV inclusion