CVE-2024-49876

What it actually does

Use-after-free in Linux kernel drm/xe driver when final queue destruction work is queued on a system workqueue that can outlive the driver instance, allowing references to freed structures after teardown.

Why it matters to the business

Kernel instability, crashes, or potential privilege escalation on affected systems; low exploit probability but requires prompt patching of deployed Linux kernels, especially in graphics-heavy or virtualized environments.

How an attack unfolds

An attacker with local access times driver unload or shutdown to leave active workqueue items referencing freed queue objects; listed threat actors in zero-day campaigns and kernel resource issues could leverage similar timing windows for UAF.

How to fix it

Apply kernel patches containing commit 861108666cc0e999cffeab6aff17b662e68774e3; for listed Puma packages upgrade to version 5.6.8 or later.

How to confirm the fix worked

Confirm kernel version contains the fix, verify xa_array drains cleanly before driver fini, and run targeted drm/xe queue destruction tests under load.

Typical attack path

1. Obtain local code execution on target system
2. Trigger drm/xe driver initialization and queue activity
3. Force driver teardown while work items remain queued
4. Access freed memory via lingering workqueue callback to achieve UAF

How to detect it

Review kernel logs for UAF splats referencing drm/xe queues or workqueue callbacks after driver unload; correlate with process activity around module removal.

What your security team should do

• Prioritize kernel updates on all systems using drm/xe
• Monitor for related Linux kernel UAF and out-of-bounds issues reported in campaigns
• Harden workqueue usage and driver unload paths in custom builds