CVE-2024-53049

What it actually does

Direct invocation of internal __kmalloc_cache_noprof without an alloc_hook wrapper leaves current->alloc_tag null, triggering a warning in alloc_tagging_slab_alloc_hook when the slub_kunit test module runs.

Why it matters to the business

Kernel warning messages appear during testing or module loading, potentially disrupting kernel development, CI pipelines, and diagnostic workflows without affecting production data or availability.

How an attack unfolds

An attacker loads the slub_kunit module (via modprobe) and exercises test_kmalloc_redzone_access, which calls the unwrapped allocator and produces the warning; no further impact or code execution is possible.

How to fix it

Apply the upstream fix that adds an alloc_hook layer around the call inside lib/slub_kunit.c; update to the kernel commit 79aea7dfd98fbbf282d1408fc21849fc9a677768 or later stable releases containing this change.

How to confirm the fix worked

Load the slub_kunit module after patching and confirm the absence of the alloc_tagging_slab_alloc_hook warning; verify the presence of the alloc_hook wrapper in the source and that the referenced commit is included.

Typical attack path

1. Obtain ability to load kernel modules
2. Execute modprobe slub_kunit
3. Trigger kunit test case that invokes __kmalloc_cache_noprof
4. Observe warning in kernel log

How to detect it

Search kernel logs (dmesg, /var/log/kern.log, journalctl) for the WARNING line referencing alloc_tagging_slab_alloc_hook and the call trace containing test_kmalloc_redzone_access and __kmalloc_cache_noprof.

• alloc_tagging_slab_alloc_hook+0x268/0x27c
• test_kmalloc_redzone_access+0x50/0x10c [slub_kunit]
• WARNING: CPU: .* PID: .* at .* alloc_tag.h:125

What your security team should do

• Prioritize kernel updates containing commit 79aea7dfd98fbbf282d1408fc21849fc9a677768 on development and test systems
• Restrict module loading to signed modules only in production environments
• Monitor kernel logs for the specific alloc_tagging warning pattern during routine testing