CVE-2024-49901

What it actually does

Null pointer dereference in msm_gpu_cleanup() when msm_gpu->pdev remains unassigned during early GPU initialization failures such as speedbin or DT parsing errors, resulting in kernel oops or crash.

Why it matters to the business

Systems using Adreno GPUs on affected Linux kernels may experience unexpected crashes during graphics initialization, leading to downtime and requiring kernel updates across many deployments.

How an attack unfolds

An attacker with local access triggers GPU device probe paths that fail before pdev assignment, causing cleanup routines to dereference a null pointer and panic the kernel; listed threat actors have been associated with similar Linux kernel memory issues but no confirmed exploitation of this specific flaw.

How to fix it

Update to patched kernel versions including commit 9288a9676c529ad9c856096db68fad812499bc4a or Rocky Linux 8 package 2.7.6-11.el8; rebuild and reboot with the fixed kernel.

How to confirm the fix worked

Verify kernel source contains the pdev assignment before msm_gpu_cleanup calls; boot test systems with failing DT configurations and confirm no null dereference oops occur.

Typical attack path

1. Obtain local user access on target Linux system with Adreno GPU
2. Trigger GPU initialization failure via missing DT properties or speedbin catalog issues
3. Force call to msm_gpu_cleanup() while pdev is still NULL
4. Induce null dereference leading to kernel panic or potential memory corruption

How to detect it

Review kernel logs for oops or panic messages referencing msm_gpu_cleanup, adreno, or null pointer dereferences during drm/msm probe; correlate with GPU device initialization failures.

• msm_gpu_cleanup
• platform_set_drvdata.*NULL
• adreno.*speedbin
• opp-supported-hw

What your security team should do

• Prioritize kernel updates on all systems with Adreno GPUs due to memory corruption risk
• Monitor for kernel oops in graphics initialization paths
• Test patched kernels in staging environments before broad rollout