CVE-2024-50028

What it actually does

Use-after-free in Linux kernel thermal core: thermal_zone_get_by_id() returns a zone pointer without holding a device reference, allowing netlink callers to access the object after it is freed under thermal_list_lock.

Why it matters to the business

Affected Linux systems risk kernel crashes, denial of service, or local privilege escalation, potentially disrupting servers, embedded devices, and cloud workloads that rely on thermal management; low EPSS indicates limited observed exploitation but still requires prompt patching given kernel-wide exposure.

How an attack unfolds

An attacker with local access invokes thermal netlink operations while concurrently triggering zone removal; the missing reference count lets the freed zone be dereferenced, leading to memory corruption that can be turned into code execution. Threat actors in 2024 espionage and financially motivated campaigns have targeted similar Linux kernel use-after-free and out-of-bounds issues.

How to fix it

Apply the upstream fix commit c95538b286efc6109c987e97a051bc7844ede802 or later stable kernels; Rocky Linux 8 users must update samba to 4.14.5-7.el8_5 or newer packages that incorporate the corrected thermal core.

How to confirm the fix worked

Confirm the running kernel contains commit c95538b286efc6109c987e97a051bc7844ede802, inspect thermal_zone_get_by_id() for get_device() under thermal_list_lock, and run regression tests exercising thermal netlink paths during zone removal.

Typical attack path

1. Obtain local access on a system exposing thermal netlink
2. Race thermal_zone_get_by_id() callers against zone unregister
3. Trigger use-after-free via freed object dereference
4. Leverage resulting kernel memory corruption for privilege escalation or DoS

How to detect it

Review kernel ring buffer and audit logs for thermal zone use-after-free warnings, netlink thermal family messages coinciding with zone unregister events, and unexpected process crashes in thermal-related code paths; correlate with threat actor TTPs targeting Linux kernel memory safety flaws.

What your security team should do

• Prioritize kernel upgrades on all affected hosts within the next maintenance window
• Enable kernel hardening features such as KASAN or hardened usercopy where available
• Monitor kernel logs for thermal-related oops and netlink anomalies
• Limit unprivileged access to thermal netlink interfaces via LSM or seccomp policies