CVE-2024-50027

What it actually does

Use-after-free in the Linux kernel thermal core where tz->tzp is accessed after being freed during thermal_zone_device_unregister() before removal completion.

Why it matters to the business

Linux systems handling thermal zones face risk of kernel instability or privilege escalation leading to service disruption or unauthorized access on servers and embedded devices.

How an attack unfolds

An attacker triggers concurrent thermal zone operations to access the tzp pointer after free, potentially allowing arbitrary read/write or denial of service in the kernel.

How to fix it

Update the Linux kernel to include commit eabe285e1c629a719d6e68fc319939c63b83bf22 or later; apply distribution-specific updates such as mailman 2.1.29-12.module+el8.5.0+717+27fd1ba7.2 on Rocky Linux 8.

How to confirm the fix worked

Verify kernel source contains the patch moving tzp free after removal completion; test thermal zone registration/unregistration sequences under load to confirm no dangling accesses remain.

Typical attack path

1. Identify systems exposing thermal zone interfaces
2. Trigger thermal_zone_device_unregister while holding references
3. Perform concurrent access to the freed tzp structure
4. Exploit the resulting use-after-free for memory corruption or control flow hijack

How to detect it

Review kernel logs for use-after-free warnings or oops involving thermal_zone_device_unregister; inspect audit trails for unusual thermal zone manipulation patterns.

What your security team should do

• Prioritize kernel upgrades on all affected Linux deployments within standard patch windows
• Monitor for thermal-related kernel oops or warnings in production logs
• Restrict unprivileged access to thermal sysfs interfaces where feasible