CVE-2024-53198

What it actually does

Missing release of resources allocated during probe() in xenbus_dev_probe() on error path, causing reference count leak without corresponding remove operation.

Why it matters to the business

Resource leaks in kernel subsystems can degrade system stability over time, increase memory pressure, and raise operational overhead for Linux environments with Xen virtualization.

How an attack unfolds

An attacker loads or triggers a Xen bus device driver probe that fails after partial resource allocation; the missing cleanup leaves references held, which can be chained with other kernel operations to exhaust resources or enable further attacks in privileged contexts.

How to fix it

Update affected Linux kernel packages to versions containing the fix that adds the fail_remove block before fail_put; for listed packages apply the provided fixed versions such as flashplugin-nonfree 11.2.202.632ubuntu0.14.04.1 on Ubuntu 14.04 LTS.

How to confirm the fix worked

Confirm kernel source contains the goto to fail_remove after the probe error check at the equivalent of line 313 and that xenbus_dev_remove() style cleanup is present; test probe failure paths to verify no reference count increase without matching release.

Typical attack path

1. Identify or control conditions that invoke xenbus_dev_probe() for a driver
2. Force an error return from drv->probe(dev, id) after allocations occur
3. Observe that no remove() is called due to direct return instead of goto fail_remove
4. Repeat to accumulate leaked references and induce resource exhaustion

How to detect it

Review kernel logs for repeated xenbus probe failures without corresponding remove events; inspect reference count traces or memory leak detectors around xenbus_dev_probe paths; correlate with any reported uninitialized resource or out-of-bounds activity in Linux kernel contexts.

What your security team should do

• Prioritize kernel updates on Xen-enabled systems given the resource management flaw
• Monitor EPSS and threat actor reports for any rise in exploitation attempts against similar Xen bus paths
• Audit custom or third-party Xen drivers for analogous probe/remove pairing issues
• Apply the exact fixed package versions listed for flashplugin-nonfree where present