CVE-2024-50026

What it actually does

Use of stale scsi_pointer from hostdata->connected during SCSI selection phase before the pointer is valid, causing oops in wd33c93_intr() due to uninitialized resource access.

Why it matters to the business

Kernel crashes and system instability on Linux systems using the wd33c93 SCSI controller, potentially leading to downtime and data loss in storage-dependent environments; low EPSS and no KEV status indicate limited immediate widespread risk despite presence in Linux kernel ecosystem.

How an attack unfolds

An attacker with local access or ability to trigger SCSI device operations could force a selection phase where hostdata->connected holds an invalid value, dereferencing the stale pointer; listed threat actors in Linux kernel campaigns could potentially leverage similar uninitialized resource flaws, though this specific issue shows no active exploitation.

How to fix it

Update to fixed kernel versions including commit 3afeceda855dea9b85cddd96307d4d17c8742005 in the stable Linux git tree; for Rocky Linux 8 thunderbird package update to 0:91.4.0-2.el8_5 or later; apply vendor kernel patches promptly given published date and days since disclosure.

How to confirm the fix worked

Verify kernel source contains the fix initializing scsi_pointer from hostdata->selecting instead of hostdata->connected; confirm no oops in wd33c93_intr() under SCSI selection workloads; check package versions against provided fixed versions for affected distributions.

Typical attack path

1. Gain local access or control over SCSI device interactions on affected kernel
2. Trigger SCSI selection sequence before hostdata->connected is populated
3. Cause wd33c93_intr() to dereference stale scsi_pointer from hostdata->selecting mismatch
4. Induce kernel oops and potential system crash or instability

How to detect it

Review kernel logs for oops or panic messages referencing wd33c93_intr() or scsi_pointer; examine dmesg output around SCSI device initialization or selection events; correlate with threat actor mentions of Linux kernel uninitialized resource issues for broader hunting.

What your security team should do

• Prioritize kernel updates on systems with wd33c93 hardware within standard patch cycles due to absent KEV status
• Monitor for kernel oops logs related to SCSI drivers post-update
• Audit Linux kernel versions across fleet for exposure to the regression commit dbb2da557a6a
• Test SCSI workloads after patching to validate stability