CVE-2024-53075

What it actually does

Missing of_node_put on CPU device node during RISC-V cache leaf population when ACPI enabled, combined with absent error check on node acquisition, produces reference count leak that enables use-after-free on the node object.

Why it matters to the business

RISC-V systems using ACPI may experience kernel instability, crashes, or memory corruption; widespread kernel deployments increase exposure and necessitate prioritized patching to avoid operational disruption.

How an attack unfolds

An attacker with local access on an affected RISC-V system with ACPI enabled triggers the cache population path; the unbalanced reference count allows reuse of a freed CPU node object for privilege escalation or denial of service, consistent with observed patterns in Linux kernel use-after-free campaigns by espionage and financially motivated actors.

How to fix it

Upgrade the Linux kernel to commit 80aec5a855106c668b5978c48e789f010198b832 or an equivalent stable release that moves node initialization past the ACPI block and adds the -ENOENT error check.

How to confirm the fix worked

Confirm the fix is present by inspecting the source for of_node_put placement after the ACPI conditional and the added error return when acquiring the device node; test cache population on ACPI-enabled RISC-V hardware.

Typical attack path

1. Gain local execution on RISC-V Linux system with ACPI enabled
2. Trigger CPU cache leaf population code path
3. Exploit freed CPU device node via use-after-free
4. Escalate privileges or cause kernel panic

How to detect it

Review kernel logs and dmesg for reference count imbalance warnings or CPU device node errors during boot or cache initialization on RISC-V ACPI systems; correlate with process activity that exercises cache population paths.

What your security team should do

• Apply the referenced kernel commit or newer release across all RISC-V deployments within standard change windows
• Prioritize systems running ACPI-enabled RISC-V configurations
• Monitor kernel logs for reference count warnings or CPU node oops until patches are deployed