CVE-2024-50021

What it actually does

Reference count leak in ice_dpll_init_rclk_pins() when WARN_ON((!vsi || !vsi->netdev)) triggers after ice_dpll_get_pins() has already incremented resource counts, leaving acquired pins unreleased.

Why it matters to the business

Gradual exhaustion of kernel resources on systems using Intel E800-series NICs can lead to degraded performance or denial of service in container and virtualization workloads; widespread use of affected packages increases exposure across enterprise Linux deployments.

How an attack unfolds

An attacker with local or network-adjacent access triggers repeated invocations of the DPLL pin initialization path under conditions that satisfy the late validation check, causing incremental reference count leaks without any requirement for code execution or privilege escalation beyond normal device interaction.

How to fix it

Upgrade the Linux kernel to commit aefecead9d08f4a35ab6f51ba2e408d2cef4e31d or later. For Rocky Linux 8 container ecosystem packages apply the listed fixed versions: fuse-overlayfs 0.7.8-1, containernetworking-plugins 0.8.3-4, runc 1.0.0-66.rc10, skopeo 0.1.41-4, cockpit-podman 11-1, python-podman-api 1.2.0-0.2, udica 0.2.1-2, container-selinux 2.130.0-1, podman 1.6.4-26, slirp4netns 0.4.2-3, criu 3.12-9, toolbox 0.0.7-1, buildah 1.11.6-9, conmon 2.0.15-1.

How to confirm the fix worked

Confirm presence of the patch by checking kernel source for the reordered validation check before ice_dpll_get_pins(), or verify installed package versions match the fixed releases above.

Typical attack path

1. Locate hosts running vulnerable kernel versions with the ice driver loaded
2. Cause repeated calls into ice_dpll_init_rclk_pins() that hit the error path
3. Accumulate unreleased references until kernel memory or object limits are reached
4. Induce service degradation or crash on affected systems

How to detect it

Search kernel logs and dmesg for repeated ice_dpll_init_rclk_pins warnings or WARN_ON messages; inspect /proc/meminfo or slabinfo for unexpected growth in ice-related objects on affected hardware.

What your security team should do

• Apply kernel and package updates immediately on all systems exposing the ice driver
• Prioritize hosts running container workloads given the listed affected packages
• Monitor kernel logs for ice_dpll related warnings during the remediation window
• Reboot systems after kernel updates to load corrected modules