CVE-2024-50149

What it actually does

Freeing a job object inside the TDR handler can race with the run_job thread and produce a use-after-free when the scheduler later dereferences the freed job.

Why it matters to the business

Systems running affected Linux kernels with Intel Xe graphics may experience crashes or allow local attackers to execute arbitrary code, potentially disrupting workloads and requiring urgent patching across fleets.

How an attack unfolds

An attacker with local access triggers a GPU timeout that activates TDR; TDR frees the job while the scheduler thread still holds a reference, enabling the attacker to re-use the freed memory for code execution. Named threat actors have shown interest in similar Linux kernel UAF issues during 2024 campaigns.

How to fix it

Upgrade to kernel versions containing commit ea2f6a77d0c40d97f4a4dc93fee4afe15d94926d. For the listed packages apply firefox 42.0+build2-0ubuntu0.14.04.1 or thunderbird 1:38.4.0+build3-0ubuntu0.14.04.1 (or later) and reboot.

How to confirm the fix worked

Confirm the running kernel contains the fix by checking git commit ea2f6a77d0c40d97f4a4dc93fee4afe15d94926d or verifying the TDR path no longer calls job free; re-run graphics stress tests that previously triggered TDR.

Typical attack path

1. Obtain local code execution on a system using the vulnerable drm/xe driver
2. Craft workload that forces a GPU command timeout
3. Trigger TDR path that frees the job object
4. Reclaim freed memory and hijack scheduler dereference for privilege escalation

How to detect it

Search kernel logs for drm/xe TDR entries that coincide with job-related crashes or scheduler warnings; look for use-after-free reports in dmesg around the time of graphics timeouts. Threat actor interest in similar Linux kernel flaws indicates monitoring for anomalous local process behavior.

What your security team should do

• Prioritize patching kernel packages on all systems exposing Intel Xe hardware
• Monitor for local privilege-escalation attempts on graphics subsystems
• Apply the exact fixed package versions provided for firefox and thunderbird on Ubuntu 14.04 LTS
• Review EPSS trend stability and absence from KEV before deprioritizing