CVE-2024-50174

What it actually does

Race condition in XArray handling within drm/panthor where pointer retrieval and reference count increment are not atomic, allowing concurrent xa_erase to interfere.

Why it matters to the business

Kernel instability or potential privilege escalation on systems using the panthor DRM driver, increasing risk of crashes or unauthorized access in graphics workloads.

How an attack unfolds

Attacker triggers simultaneous group handle operations in the panthor driver to exploit the window between XArray lookup and refcount bump, potentially leading to use-after-free conditions.

How to fix it

Update the Linux kernel to a version that holds the XArray lock while incrementing the reference count in drm/panthor.

How to confirm the fix worked

Confirm the applied kernel patch enforces XArray locking during refcount operations and test concurrent group handle access scenarios.

Typical attack path

1. Locate systems exposing the panthor DRM driver
2. Induce concurrent group handle add/remove operations
3. Win the race to dereference freed objects
4. Escalate privileges or cause denial of service

How to detect it

Review kernel logs and dmesg for panthor group handle errors, XArray warnings, or use-after-free reports in the drm module.

What your security team should do

• Prioritize kernel updates for affected distributions
• Monitor kernel logs for panthor-related race or refcount warnings
• Limit untrusted access to 3D acceleration where feasible