CVE-2024-49853

What it actually does

Double free of channel descriptors in the SCMI OPTEE transport when channels shared between protocols are freed twice during stack unload, resulting in memory corruption.

Why it matters to the business

Linux kernel systems using ARM SCMI with OPTEE may experience crashes, instability, or potential privilege escalation; low exploitation likelihood reduces immediate urgency despite broad kernel prevalence.

How an attack unfolds

An attacker triggers repeated protocol unload operations on shared channels to force the double-free condition in arm_scmi transport; listed threat actors have targeted similar Linux kernel memory issues in zero-day campaigns but no confirmed activity against this flaw.

How to fix it

Apply the kernel fix from commit d7f4fc2bc101e666da649605a9ece2bd42529c7a; upgrade to a stable release containing this patch; for affected Ruby packages update actionpack to 6.0.3.5 or 6.1.2.1 where applicable.

How to confirm the fix worked

Verify kernel source contains the referenced commit or check running kernel version against fixed releases; monitor for absence of double-free warnings in arm_scmi during protocol unload tests.

Typical attack path

1. Gain local access or ability to load/unload SCMI protocols
2. Identify or force shared channel usage across protocols
3. Trigger stack unload to cause second free of descriptors
4. Leverage resulting memory corruption for crash or code execution

How to detect it

Search kernel logs for arm_scmi double-free or oops messages during module unload; correlate with protocol teardown events; review threat actor patterns around Linux kernel memory flaws for similar artifacts.

What your security team should do

• Prioritize kernel updates on systems using ARM SCMI OPTEE transport
• Test protocol unload paths in staging environments before production rollout
• Review downstream kernel dependents for backport needs given ecosystem reach