CVE-2024-56561

What it actually does

Use-after-free in pci_epc_destroy() caused by passing a device pointer already freed by device_unregister() to pci_bus_release_domain_nr() and using the wrong device instead of the EPC parent.

Why it matters to the business

Kernel instability or potential local code execution on Linux systems exposing PCI endpoint controllers, increasing risk of crashes or compromise in embedded and server environments.

How an attack unfolds

An attacker with local access crafts PCI endpoint device setup and teardown sequences to trigger pci_epc_destroy() after the device has been unregistered, exploiting the freed pointer for memory corruption.

How to fix it

Update the Linux kernel to include commit c74a1df6c2a2df7dd45c3fc1a5edc29a075dcf22 which reorders the domain release before device_unregister() and passes epc->dev.parent.

How to confirm the fix worked

Confirm presence of the fix commit in kernel sources; exercise PCI endpoint create/destroy paths and monitor for use-after-free reports in debug kernels.

Typical attack path

1. Obtain local access on a vulnerable Linux kernel with PCI endpoint support
2. Initialize and configure a PCI endpoint controller
3. Trigger pci_epc_destroy() under timing conditions that expose the freed pointer
4. Leverage resulting use-after-free for memory corruption and privilege escalation

How to detect it

Inspect kernel logs and crash dumps for use-after-free reports referencing pci_bus_release_domain_nr or pci_epc_destroy; correlate with PCI endpoint device registration events.

What your security team should do

• Apply the referenced kernel commit or distribution update to all affected systems
• Prioritize systems exposing PCI endpoint functionality
• Review kernel configurations to disable unused PCI endpoint support where feasible