CVE-2024-49986

What it actually does

Use-after-free in the Linux kernel x86-android-tablets driver: x86_android_tablet_remove() frees the pdevs[] array, but on platform_device_register() failure the code accessed pdevs[x] afterward, allowing memory corruption.

Why it matters to the business

Local attackers on affected Linux systems can achieve privilege escalation or kernel crashes; low immediate risk due to no KEV listing, stagnant low EPSS, and limited ecosystem prevalence outside specific tablet platforms.

How an attack unfolds

An attacker with local access triggers the error path during platform device registration in the x86-android-tablets code; the subsequent use of the now-freed pdevs[] array enables memory corruption that can be turned into code execution, consistent with patterns seen in broader 2024 Linux kernel exploitation campaigns by espionage and financially motivated actors.

How to fix it

Upgrade the Linux kernel to commit ba0b09a2f327319e252d8f3032019b958c0a5cd9 or later; apply the corresponding fixed package versions for any listed Ruby components on Rocky Linux 8 (rubygem-abrt 0.4.0-1, rubygem-bson 4.8.1-1, rubygem-mongo 2.11.3-1, rubygem-mysql2 0.5.3-1, rubygem-pg 1.2.3-1, ruby 2.7.4-137).

How to confirm the fix worked

Verify the running kernel contains commit ba0b09a2f327319e252d8f3032019b958c0a5cd9; confirm platform/x86/x86-android-tablets.c no longer performs the post-free access on register failure.

Typical attack path

1. Obtain local user access on a vulnerable Linux system
2. Trigger platform_device_register() failure in the x86-android-tablets driver
3. Force use of the freed pdevs[] array
4. Corrupt kernel memory to escalate privileges or crash the system

How to detect it

Inspect kernel logs for use-after-free warnings or oops related to x86_android_tablet_remove and platform_device_register; correlate with local process activity attempting device registration on x86 Android tablet platforms.

What your security team should do

• Patch affected Linux kernels immediately given the 721 days since publication
• Prioritize systems exposing the x86-android-tablets driver
• Monitor for local privilege-escalation attempts while patches are applied
• Review downstream package dependencies for the listed Rocky Linux fixes