CVE-2024-49981

What it actually does

Race condition between venus_remove (which frees hdev via hfi_destroy) and a pending venus_sys_error_handler work item that later accesses the freed structure via hfi_reinit and venus_hfi_queues_reinit.

Why it matters to the business

Potential kernel crashes, denial of service, or limited code execution on Linux systems performing media operations with the venus driver; low EPSS and absence from KEV indicate limited real-world exploitation but still requires prompt patching given widespread kernel use.

How an attack unfolds

An attacker triggers venus_event_notify to queue the error handler work, then concurrently invokes venus_remove to destroy HFI and free structures before the work runs, leading to use-after-free when the handler executes hfi_reinit.

How to fix it

Apply the fix from commit 5098b9e6377577fe13d03e1d8914930f014a3314 in the Linux kernel stable trees; for Rocky Linux 8 update lz4 to 0:1.8.3-3.el8_4 or later equivalent package versions containing the venus_remove cancellation logic.

How to confirm the fix worked

Confirm presence of cancel_work_sync or equivalent work cancellation in venus_remove function in kernel source; verify running kernel version or commit hash matches a fixed revision; test device probe/remove under error injection.

Typical attack path

1. Trigger venus_event_notify to schedule venus_sys_error_handler work
2. Call venus_remove from another context while work is pending
3. Execute hfi_destroy and kfree(hdev) in remove path
4. Allow scheduled work to run hfi_reinit on freed memory

How to detect it

Inspect kernel logs for oops or warnings referencing venus_sys_error_handler, hfi_reinit, or use-after-free in the venus driver; correlate with device removal events in dmesg or journalctl around media subsystem activity.

What your security team should do

• Prioritize kernel upgrades to fixed versions across all affected distributions within standard patch windows
• Review media/venus driver usage in embedded or multimedia workloads for additional hardening
• Monitor stable kernel mailing lists for backports given 721 days since publication