CVE-2024-56576

What it actually does

Use-after-free in tc358743 i2c driver: probe error path fails to cancel an active polling timer, allowing the timer callback to dereference already-freed memory and trigger a kernel crash in __run_timers.

Why it matters to the business

Driver initialization failures on affected hardware can cause immediate kernel panics or system instability, resulting in unexpected downtime and reduced reliability for media or video capture workloads.

How an attack unfolds

An attacker or misbehaving hardware triggers an error during tc358743 probe after the polling timer has been armed; when the timer later expires it accesses freed structures, producing a crash. No remote code execution path is known; impact is limited to denial-of-service via kernel fault.

How to fix it

Upgrade the affected qemu package on Ubuntu 14.04 LTS to version 2.0.0+dfsg-2ubuntu1.26 or later; apply the upstream kernel fix that cancels the polling timer on probe failure.

How to confirm the fix worked

Verify the running kernel contains the commit that removes the timer in the error path; confirm absence of the exact WARNING stack trace in dmesg after simulated probe failures.

Typical attack path

1. Load or bind the tc358743 driver under conditions that cause probe to fail after timer setup
2. Allow the polling timer to expire after the probe error path has freed associated data
3. Timer callback executes with dangling pointers, hitting the warning in __run_timers and crashing the system

How to detect it

Search kernel logs and dmesg for the exact WARNING string from __run_timers together with the call trace containing timer_expire_remote and the tc358743 module; correlate with probe failure events.

• WARNING: CPU:.*at kernel/time/timer.c:.*__run_timers
• timer_expire_remote+0x50/0x68
• tc358743
• dead000000000122

What your security team should do

• Apply the fixed qemu package version immediately on all Ubuntu 14.04 systems using the tc358743 driver
• Monitor kernel logs for timer-related warnings during driver load
• Test driver error paths in staging environments before production rollout