CVE-2024-49925

What it actually does

Use-after-free in efifb sysfs attribute handling allows references to freed info struct after unregister, enabling local denial of service via kernel panic or memory corruption.

Why it matters to the business

Local users on affected Linux systems can trigger crashes that interrupt workloads, reduce availability, and require reboots; low exploitability limits widespread impact but still affects stability on EFI framebuffer systems.

How an attack unfolds

An attacker with local access loads or unloads the efifb driver or triggers device removal, racing the sysctl attribute access against the freed info struct to cause a use-after-free; listed threat actor campaigns involving kernel memory issues could adapt similar local primitives.

How to fix it

Update the Linux kernel to the fixed commit 2a9c40c72097b583b23aeb2a26d429ccfc81fbc1 or later stable release that registers sysfs groups via the driver core; reboot after patching.

How to confirm the fix worked

Confirm the efifb driver uses devm device-managed sysfs groups and that the info struct is freed only after attribute cleanup; inspect dmesg for removed UAF warnings and test driver load/unload cycles.

Typical attack path

1. Obtain local user access on a Linux system using efifb
2. Trigger efifb driver unload or device unregister path
3. Race sysctl attribute access against freed struct
4. Cause kernel panic or attempt memory corruption for denial of service

How to detect it

Review kernel logs for efifb-related oops, use-after-free warnings, or panic traces during driver unload; inspect for unexpected sysfs attribute access after efifb unregistration events.

What your security team should do

• Prioritize kernel updates on systems exposing efifb (workstations, embedded EFI devices)
• Restrict local unprivileged access where possible until patched
• Monitor for kernel oops or panic logs related to efifb
• Apply the fix across all distributions using the referenced stable commit