CVE-2024-50122

What it actually does

Race condition between pwrctl platform device rescan and host controller probe allows two incompletely added PCI devices, resulting in NULL pointer dereference during sysfs removal via pci_remove_sysfs_dev_files and kernfs_find_ns.

Why it matters to the business

Kernel crashes and system instability during PCI device management on affected Linux kernels; low EPSS and no KEV status indicate limited active exploitation risk despite 706 days since publication, but unpatched systems face potential denial-of-service in device hotplug or power-control scenarios.

How an attack unfolds

Local attacker triggers concurrent bus rescan from pwrctl platform device while host probe adds devices without the rescan lock, then issues sysfs remove_store to hit the incomplete device state and crash; threat actors listed in Linux kernel resource and bounds issues may explore similar races.

How to fix it

Apply the fix in commit d4f38a0e7cc94615f63cf7765ca117e5cc2773ae or later stable kernel; upgrade affected packages to listed fixed versions such as samba 2:4.1.6+dfsg-1ubuntu2.14.04.11 or 2:4.3.3+dfsg-1ubuntu1 where applicable.

How to confirm the fix worked

Confirm kernel contains the rescan lock acquisition during host probe; reproduce PCI device add/remove cycle without crash and verify absence of the described oops trace.

Typical attack path

1. Obtain local access on target Linux system
2. Trigger PCI host controller probe
3. Initiate concurrent pwrctl rescan of the bus
4. Perform sysfs device removal operation
5. Induce kernel NULL pointer dereference crash

How to detect it

Search kernel logs and oops reports for the exact crash signature involving __pi_strlen, kernfs_find_ns, pci_remove_sysfs_dev_files, and pci_stop_bus_device; correlate with sysfs write activity to remove_store.

• Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000
• __pi_strlen+0x14/0x150
• kernfs_find_ns+0x80/0x13c
• pci_remove_sysfs_dev_files+0x28/0x38
• remove_store+0x70/0xb0

What your security team should do

• Prioritize kernel updates to the fixed commit on all affected systems
• Monitor kernel logs for the specific NULL dereference call trace
• Test PCI hotplug and power-control functionality after patching
• Review device management scripts for concurrent rescan patterns