CVE-2024-50030

What it actually does

Use-after-free in drm/xe/ct send_recv() due to fence object on stack going out of scope after timeout without proper serialization against completion path and missing memory barriers for dependent loads/stores.

Why it matters to the business

Attackers with local access may crash systems or escalate privileges on affected Linux distributions, leading to downtime, data exposure, or full host compromise; high downstream kernel prevalence increases urgency for patching across server and workstation fleets.

How an attack unfolds

An attacker with local access triggers the drm/xe command transport path to cause a fence to timeout, races the completion handler to free the object, then reuses the dangling reference via the unlocked XA entry before the stack variable is erased.

How to fix it

Upgrade Linux kernel to commit 8ed7dd4c55e4fb21531a9645aeb66a30eaf43a46 or later; for Rocky Linux 8 apply postgresql 12.9-1, pgaudit 1.4.0-5, pg_repack 1.4.6-3, and postgres-decoderbufs 0.10.0-2 module updates that include the fix.

How to confirm the fix worked

Confirm kernel version contains commit 8ed7dd4c55e4fb21531a9645aeb66a30eaf43a46; run targeted stress tests exercising xe ct send_recv() under timeout conditions and verify no UAF warnings in dmesg or KASAN logs.

Typical attack path

1. Obtain local unprivileged shell on target system
2. Trigger drm/xe ct send_recv() code path with crafted timing to induce timeout
3. Race completion side to free fence while still referenced in XA
4. Reuse freed object via dependent load/store to achieve UAF read/write or control flow hijack

How to detect it

Review kernel logs for drm/xe ct timeout messages followed by use-after-free warnings; inspect XA fence handling paths and correlate with local process activity that exercises GPU command transport.

What your security team should do

• Prioritize kernel and listed Rocky Linux module updates on all systems exposing drm/xe hardware
• Monitor EPSS and threat actor reports for any increase in in-the-wild exploitation
• Apply defense-in-depth: restrict untrusted local code execution and enable KASAN or similar hardening where feasible