CVE-2024-50005

What it actually does

The flaw permits access to the RCU-protected scan_req->type field after the RCU read-side critical section ends in mac802154_scan_worker, violating RCU rules and enabling use-after-free conditions through stale or freed memory dereference.

Why it matters to the business

Kernel instability, crashes, or potential privilege escalation on Linux systems running affected container and networking stacks can disrupt operations, increase downtime, and raise exploitation risk in environments with high package prevalence such as Rocky Linux container hosts.

How an attack unfolds

An attacker triggers mac802154 scan operations to enter the worker function, then races memory updates or frees against the unlocked access to scan_req->type, leading to use-after-free; listed threat actors in 2024 zero-day and Linux kernel campaigns may target similar kernel issues for espionage or financial gain.

How to fix it

Apply the kernel commit e676e4ea76bbe7f1156d8c326b9b6753849481c2 and update affected Rocky Linux 8 packages to the listed fixed versions including podman 0:3.3.1-9.module+el8.5.0+710+4c471e88, runc 0:1.0.2-1.module+el8.5.0+710+4c471e88, and containers-common 2:1-2.module+el8.5.0+710+4c471e88.

How to confirm the fix worked

Verify the applied kernel commit hash matches e676e4ea76bbe7f1156d8c326b9b6753849481c2, confirm package versions match the fixed module strings, and test mac802154 scan operations under RCU stress to ensure no post-unlock access occurs.

Typical attack path

1. Identify systems running vulnerable Linux kernel versions with mac802154 enabled
2. Trigger or influence 802.15.4 scan requests to invoke mac802154_scan_worker
3. Race the RCU unlock with concurrent memory reuse or free operations
4. Dereference the stale pointer to achieve use-after-free for crash or code execution

How to detect it

Inspect kernel logs for oops, warnings, or panics referencing mac802154_scan_worker or RCU violations during scan operations; correlate with threat actor activity targeting Linux kernel use-after-free issues.

What your security team should do

• Immediately update kernel and all listed container packages on Rocky Linux 8 systems given the widespread downstream prevalence
• Monitor for new kernel releases incorporating the RCU fix and schedule broad fleet patching
• Review wireless 802.15.4 usage and disable mac802154 where not required to reduce attack surface