CVE-2024-50059

What it actually does

Race condition between switchtec_ntb_remove (which frees sndev) and a pending check_link_status_work that still dereferences sndev after free, resulting in use-after-free.

Why it matters to the business

Systems running affected Linux kernel versions with the switchtec NTB driver may experience crashes, memory corruption, or potential local privilege escalation; widespread kernel exposure increases urgency for patching across server and embedded deployments.

How an attack unfolds

An attacker with local access triggers module unload (or device removal) while the link status work item remains queued or running; the work then accesses the already-freed sndev structure, leading to memory corruption that can be leveraged for denial of service or code execution.

How to fix it

Update the Linux kernel to a version containing commit 5126d8f5567f49b52e21fca320eaa97977055099 which cancels the work item before freeing sndev in switchtec_ntb_remove; apply vendor backports or distribution kernels that include the fix.

How to confirm the fix worked

Confirm the presence of the canceling logic (cancel_delayed_work_sync or equivalent) before kfree(sndev) in switchtec_ntb_remove; verify kernel build contains the referenced commit or later stable patch.

Typical attack path

1. Obtain local access on a system using the switchtec_ntb driver
2. Trigger or wait for conditions that schedule check_link_status_work
3. Unload the module or remove the device to invoke switchtec_ntb_remove
4. Allow the still-pending work to dereference the freed sndev object

How to detect it

Review kernel logs for oops or panic messages referencing switchtec_ntb or check_link_status_work around module unload events; inspect dmesg or journalctl for use-after-free warnings tied to ntb_hw_switchtec.

What your security team should do

• Prioritize kernel updates on all systems exposing the switchtec NTB driver
• Audit for custom or out-of-tree modules that may reintroduce similar race patterns
• Monitor vendor advisories for distribution-specific backports