CVE-2024-55639

What it actually does

Use-after-put on a device tree node reference held in the rswitch_device structure, allowing the node to be freed while still referenced by multiple driver code paths.

Why it matters to the business

Kernel instability, crashes, or local privilege escalation on systems using affected Renesas R-Switch Ethernet drivers; high prevalence in Ubuntu LTS kernels increases exposure across server and embedded deployments.

How an attack unfolds

An attacker with local access triggers the driver paths that reuse the prematurely put device tree node, leading to a use-after-free condition that can be leveraged for memory corruption and privilege escalation.

How to fix it

Upgrade to fixed kernel versions: linux 3.13.0-87.133 or 4.4.0-24.43 (and equivalents for aws, hwe, raspi2, snapdragon, gke, lts-xenial, lts-utopic, lts-vivid, lts-wily packages as listed per Ubuntu release).

How to confirm the fix worked

Verify installed kernel package version matches or exceeds the listed fixed versions for each Ubuntu variant; confirm of_node_put calls occur only on exit paths in rswitch driver source.

Typical attack path

1. Obtain local code execution on an affected Linux system
2. Load or trigger the rswitch driver with crafted device tree or network configuration
3. Cause repeated references after the erroneous of_node_put call
4. Exploit resulting use-after-free for arbitrary read/write or control-flow hijack

How to detect it

Review kernel logs for oops/panic messages mentioning rswitch or device tree node put operations; inspect for local processes triggering network driver initialization around crash times.

What your security team should do

• Prioritize patching Ubuntu kernels using affected linux, linux-aws, linux-hwe and related packages within 30 days
• Restrict untrusted local user access on systems exposing Renesas rswitch hardware until patched
• Monitor for kernel oops or use-after-free reports referencing rswitch_device or of_node_put