CVE-2024-49879

What it actually does

Missing validation of alloc_ordered_workqueue return value in the omapdrm driver allows a NULL pointer dereference when allocation fails.

Why it matters to the business

Kernel instability or crashes on affected Linux systems can disrupt graphics operations and device availability, with limited downstream impact due to narrow driver scope.

How an attack unfolds

An attacker with local access triggers the omapdrm workqueue allocation path under memory pressure to induce failure, resulting in NULL dereference and potential kernel panic or information exposure.

How to fix it

Update the Linux kernel to commit c17a4f52fa3c3dac2dd6a3c38f2de7342d97d74c or later; for libjpeg-turbo on Rocky Linux 8 update to 1.5.3-10.el8 or newer.

How to confirm the fix worked

Confirm kernel source contains the added NULL check after alloc_ordered_workqueue; test driver initialization under low-memory conditions to verify no dereference occurs.

Typical attack path

1. Gain local execution on target Linux system
2. Trigger DRM initialization or display operations using omapdrm
3. Exhaust resources to force alloc_ordered_workqueue failure
4. Cause NULL pointer dereference leading to crash or exploitation

How to detect it

Review kernel logs for oops or panic messages referencing omapdrm and workqueue allocation failures; correlate with system events showing memory pressure before crashes.

What your security team should do

• Apply the referenced kernel commit or distribution update immediately on systems using omapdrm
• Monitor for kernel oops or panics involving workqueue allocation in DRM drivers
• Restrict unprivileged local access on multi-user systems until patched