CVE-2024-49924

What it actually does

Use-after-free in the pxafb framebuffer driver where pxafb_init_fbinfo schedules pxafb_task work that can dereference a freed fb_info structure after pxafb_remove calls unregister_framebuffer and put_fb_info during module unload.

Why it matters to the business

Local privilege escalation or kernel crash on systems using the pxafb driver; high urgency for kernels in embedded or display-heavy Linux deployments despite low exploit probability.

How an attack unfolds

Root user unloads the pxafb module, unregister_framebuffer frees the fb_info, and a concurrently scheduled pxafb_task work item then executes set_ctrlr_state and lcd_power callbacks that access the already-freed structure.

How to fix it

Apply the upstream fix in commit e657fa2df4429f3805a9b3e47fb1a4a1b02a72bd which cancels the work item in pxafb_remove before calling unregister_framebuffer; rebuild and deploy the patched kernel or update to a distribution release containing this commit.

How to confirm the fix worked

Confirm the fix commit is present in the running kernel source tree, exercise module load/unload cycles under stress, and verify absence of UAF warnings in kmemleak or KASAN output.

Typical attack path

1. Obtain root privileges on the target system
2. Trigger pxafb module removal via rmmod or modprobe -r
3. Allow the pending pxafb_task work item to run after fb_info has been freed
4. Leverage the resulting use-after-free for memory corruption or denial of service

How to detect it

Monitor kernel logs for pxafb_remove followed by pxafb_task execution, look for oops or KASAN reports referencing fb_info or set_ctrlr_state after module unload events.

• pxafb_remove
• pxafb_task
• unregister_framebuffer
• put_fb_info
• set_ctrlr_state

What your security team should do

• Prioritize kernel updates containing e657fa2df4429f3805a9b3e47fb1a4a1b02a72bd on all affected systems
• Restrict runtime module unloading to trusted administrative contexts
• Enable KASAN or similar memory debugging on test kernels to validate the fix
• Review framebuffer driver usage in embedded deployments for exposure