CVE-2024-56538

What it actually does

The vulnerability is a use-after-free in the zynqmp_kms DRM driver where userspace accesses to the device after removal but before full cleanup can reference freed memory.

Why it matters to the business

Systems running affected Linux kernels may experience kernel crashes, denial of service, or local privilege escalation with low current exploit probability; widespread kernel updates are needed across distributions using the stable tree.

How an attack unfolds

An attacker with local access on an affected system triggers concurrent userspace DRM operations while the zynqmp_kms device is being removed, causing the use-after-free condition that can be leveraged for memory corruption.

How to fix it

Update the Linux kernel to commit a17b9afe58c474657449cf87e238b1788200576b or later in the stable repository; apply distribution kernel packages that include this fix.

How to confirm the fix worked

Confirm the zynqmp_kms driver source contains the drm_dev_unplug call prior to device removal and test that userspace accesses after removal return errors without kernel oops.

Typical attack path

1. Obtain local unprivileged access to a Linux system using the zynqmp_kms driver
2. Trigger or race DRM device removal
3. Perform userspace accesses to the DRM device to hit freed memory
4. Exploit resulting memory corruption for code execution or denial of service

How to detect it

Review kernel logs and dmesg for use-after-free or oops messages involving zynqmp_kms or DRM device removal; correlate with local user activity around device hotplug or driver unload events.

What your security team should do

• Prioritize kernel updates on all systems using the zynqmp_kms driver
• Monitor kernel logs for DRM-related use-after-free warnings
• Restrict local access and unprivileged userspace DRM operations where possible