CVE-2024-49865

What it actually does

The vulnerability is a use-after-free in Linux kernel drm/xe/vm where an attacker can guess the next VM ID before ioctl completion, issue a destroy ioctl to free the object, and leave the create ioctl referencing the now-freed VM.

Why it matters to the business

Attackers could crash systems or escalate privileges on Linux hosts, leading to downtime, data exposure, or unauthorized access; high ecosystem prevalence in Linux kernels and downstream packages heightens operational risk despite low EPSS.

How an attack unfolds

An attacker guesses the VM ID during an ongoing create ioctl, issues a destroy ioctl to free the object early, then exploits the dangling reference once the original ioctl resumes; referenced in 2024 zero-day exploitation campaigns by espionage and financially motivated actors.

How to fix it

Apply the upstream fix that moves xa_alloc to the very end of the create path; for listed affected products upgrade nokogiri (RubyGems) to version 1.13.5.

How to confirm the fix worked

Confirm presence of commit dcfd3971327f3ee92765154baebbaece833d3ca9 or later equivalent in the kernel tree; test that concurrent create/destroy ioctls no longer produce use-after-free reports under sanitizers.

Typical attack path

1. Guess next VM identifier before ioctl finishes
2. Trigger create ioctl that allocates but does not yet commit the ID
3. Call destroy ioctl to free the VM object
4. Continue create ioctl to trigger reference to freed memory

How to detect it

Review kernel audit logs and drm debug output for rapid sequences of VM create followed by destroy ioctls from the same unprivileged context; correlate with any use-after-free warnings in dmesg or kmemleak reports.

What your security team should do

• Prioritize kernel updates on all drm/xe-enabled systems given 721 days since publication
• Upgrade nokogiri (RubyGems) to 1.13.5 across all Ruby environments
• Harden ioctl surfaces with additional capability checks
• Monitor threat actor activity tied to 2024 zero-day campaigns