CVE-2024-49945

What it actually does

Use-after-free in the Linux kernel NCSI subsystem where a scheduled work item can execute after the associated ncsi device structure has been freed, leading to invalid memory access or kernel panic.

Why it matters to the business

Kernel instability or crashes on affected Linux systems that use NCSI networking, potentially causing downtime for servers and network appliances; low exploitability reduces immediate risk but still requires patching due to widespread kernel usage.

How an attack unfolds

An attacker with local access or the ability to influence NCSI device lifecycle triggers scheduling of the ncsi work, then frees the device structure before the work runs, resulting in the work function dereferencing freed memory.

How to fix it

Update the Linux kernel to a version containing commit f6ca58696749268181f43150b3553f2bafd71e42 or later; rebuild and reboot affected systems. For Rocky Linux 8 curl packages, ensure 7.61.1-18.el8 or newer.

How to confirm the fix worked

Verify the running kernel contains the fix commit or is newer than the vulnerable version; inspect ncsi.c source for the work disable call before free; test NCSI device attach/detach under load to confirm no use-after-free occurs.

Typical attack path

1. Gain local code execution or trigger NCSI device allocation on a vulnerable kernel
2. Arrange for ncsi work to be queued
3. Free the ncsi device structure while the work remains pending
4. Trigger execution of the stale work item to access freed memory

How to detect it

Search kernel logs for NCSI-related oops or panic messages mentioning use-after-free; review dmesg and syslog for workqueue execution after device removal events.

What your security team should do

• Prioritize kernel upgrades on all production Linux systems within standard maintenance windows
• Monitor EPSS trend and re-evaluate if score increases significantly
• Apply the fix commit f6ca58696749268181f43150b3553f2bafd71e42 during next kernel rebuild cycle
• Review NCSI usage in network drivers and disable if unused