CVE-2024-53172

What it actually does

The flaw causes alloc_ai() to invoke slab cache creation twice using the identical name 'ubi_aeb_slab_cache' during UBI fastmap attach, triggering a duplicate cache warning from __kmem_cache_create_args when CONFIG_DEBUG_VM=y.

Why it matters to the business

Systems using UBI fastmap on Linux kernels may emit spurious kernel warnings during module initialization or device attachment on debug-enabled builds, increasing noise in logs and complicating troubleshooting without affecting runtime functionality or data integrity.

How an attack unfolds

An attacker would trigger the UBI attach path (e.g., via modprobe or ubi_attach_mtd_dev) on a DEBUG_VM kernel to surface the warning; no code execution, privilege escalation, or data access is possible. Listed threat actors relate to unrelated kernel issues such as uninitialized resources or out-of-bounds accesses.

How to fix it

Update the Linux kernel to a version containing the fix that assigns distinct slab cache names for alloc_ai callers; apply vendor-supplied UBI/UBI fastmap patches.

How to confirm the fix worked

Confirm the kernel version includes the duplicate-name fix; reproduce attach under CONFIG_DEBUG_VM=y and verify absence of the 'ubi_aeb_slab_cache already exists' warning.

Typical attack path

1. Load or initialize UBI module with fastmap enabled on a DEBUG_VM kernel
2. Invoke ubi_attach which calls alloc_ai twice using the same slab name
3. Observe the kmem_cache duplicate name warning in dmesg or logs

How to detect it

Search kernel logs and dmesg for the exact warning string produced by __kmem_cache_create_args when duplicate ubi_aeb_slab_cache names are detected during ubi_attach or modprobe of the ubi module.

• kmem_cache of name 'ubi_aeb_slab_cache' already exists
• WARNING: CPU:.*PID:.*at mm/slab_common.c:107
• alloc_ai.*ubi
• ubi_attach.*ubi

What your security team should do

• Prioritize kernel updates for any systems exposing UBI fastmap in debug configurations
• Monitor kernel logs for slab cache warnings during storage driver initialization
• Review EPSS trend and absence from KEV to deprioritize immediate incident response