CVE-2024-49992

What it actually does

Use-after-free in drm/stm ltdc_load() due to passing devm_kzalloc-allocated objects to drm_crtc_init_with_planes, drm_universal_plane_init and drm_encoder_init instead of DRM-managed allocations.

Why it matters to the business

Potential kernel crashes or local privilege escalation on Linux systems using the STM display controller driver; widespread kernel updates required across affected distributions.

How an attack unfolds

An attacker with local access loads or triggers the ltdc driver, causing the DRM framework to reference freed crtc/plane structures after the devm-managed memory is released, leading to memory corruption.

How to fix it

Update the Linux kernel to a version containing commit d02611ff001454358be6910cb926799e2d818716 or later; apply distribution-specific updates such as nodejs 1:14.17.5-1.module+el8.4.0+654+17ff1d38 where applicable.

How to confirm the fix worked

Verify the running kernel contains the referenced commit or equivalent backport; inspect ltdc_load source to confirm DRM-managed allocation calls replace devm_kzalloc usage.

Typical attack path

1. Obtain local code execution on target system
2. Trigger loading or reinitialization of the stm ltdc DRM driver
3. Cause drm_crtc_init_with_planes / drm_universal_plane_init / drm_encoder_init to receive devm_kzalloc objects
4. Trigger subsequent use of the now-freed structures to achieve memory corruption or crash

How to detect it

Review kernel logs for use-after-free warnings or oops traces referencing drm_crtc, ltdc, or stm driver initialization; correlate with unexpected process crashes during graphics driver load.

What your security team should do

• Apply kernel updates containing the fix immediately on all systems exposing the stm drm driver
• Monitor for new kernel releases from distributions and rebuild custom kernels with the patch
• Restrict unprivileged local access on systems that cannot be updated promptly