CVE-2024-52332

What it actually does

pci_register_driver failure in igb_init_module leaves the dca_notifier registered, allowing it to be invoked after module installation failure and resulting in invalid memory access.

Why it matters to the business

Rare but possible kernel crashes or memory corruption on systems using the igb driver during module load errors; low urgency given minimal exploit activity and no known ransomware use.

How an attack unfolds

An attacker would need to trigger a pci_register_driver failure during igb module initialization while arranging for the dangling dca_notifier callback to execute afterward, leading to invalid memory access; no public exploits or named threat actors have been observed exploiting this path.

How to fix it

Update the Linux kernel to a version containing commit 4458046617dfadc351162dbaea1945c57eebdf36 or later; ensure the igb driver initialization properly unregisters the dca_notifier on pci_register_driver failure.

How to confirm the fix worked

Confirm the running kernel contains commit 4458046617dfadc351162dbaea1945c57eebdf36; attempt igb module load under simulated pci_register_driver failure conditions and verify no dangling notifier remains.

Typical attack path

1. Trigger conditions causing pci_register_driver to fail inside igb_init_module
2. Leave dca_notifier registered due to missing unregister on failure path
3. Cause the notifier to be invoked after module load failure
4. Achieve invalid memory access or kernel crash

How to detect it

Review kernel logs and module load traces for igb initialization failures followed by unexpected dca_notifier activity or memory faults; no widespread exploitation indicators have been reported.

What your security team should do

• Apply the fixed kernel commit or distribution update containing 4458046617dfadc351162dbaea1945c57eebdf36 as soon as feasible
• Monitor kernel logs for igb module initialization failures
• Review downstream dependents using the igb driver for exposure