CVE-2024-50061

What it actually does

Race condition in cdns_i3c_master driver allows use-after-free when module removal calls i3c_master_unregister and frees the master structure while a pending hj_work executes cdns_i3c_master_hj and i3c_master_do_daa on the now-freed object.

Why it matters to the business

Linux systems relying on the Cadence I3C controller may experience kernel instability, crashes, or local privilege escalation if the module is unloaded while hot-join work is active; limited ecosystem impact due to narrow driver scope.

How an attack unfolds

An attacker with local access triggers scheduling of hj_work via interrupt, then unloads the module to free the master base during cleanup, allowing the queued work to dereference the freed structure and potentially execute arbitrary code or cause denial of service.

How to fix it

Upgrade to a kernel containing commit 2a21bad9964c91b34d65ba269914233720c0b1ce or later; ensure cdns_i3c_master_remove cancels the hj_work before calling i3c_master_unregister.

How to confirm the fix worked

Confirm the patched commit is present in the running kernel source; test by loading the module, scheduling hj_work, and unloading while monitoring for use-after-free reports in kernel logs.

Typical attack path

1. Obtain local access on a system using the vulnerable cdns_i3c_master driver
2. Trigger an IBI event that schedules the hj_work via cdns_i3c_master_interrupt
3. Unload the module to invoke cdns_i3c_master_remove and free the master structure
4. Allow the pending work to execute and access the freed memory in i3c_master_do_daa

How to detect it

Inspect kernel logs and dmesg for use-after-free warnings or oops traces referencing cdns_i3c_master_hj, cdns_i3c_master_remove, or i3c_master_do_daa around the time of module unload events.

What your security team should do

• Apply the referenced kernel commit or distribution update immediately on affected systems
• Restrict unprivileged users from loading or unloading kernel modules
• Monitor dmesg and kernel logs for cdns_i3c_master related crashes during module operations