CVE-2024-56621

What it actually does

Failure to cancel a scheduled RTC work item during driver removal leaves a dangling workqueue entry that dereferences NULL pointers in ufshcd internal structures after the host controller has been torn down.

Why it matters to the business

Unloading or reconfiguring UFS storage drivers on affected Linux systems can trigger kernel crashes, leading to unexpected downtime and potential data loss for workloads relying on those devices; the low exploitation probability and absence from known campaigns reduce immediate urgency despite the age of the disclosure.

How an attack unfolds

An attacker with local access triggers driver removal (module unload or device hot-unplug) and then races or schedules the RTC work item; the work handler runs after structures are freed, causing the NULL dereference in pm_runtime_get_if_active and spinlock paths.

How to fix it

Update to a kernel containing the fix that cancels RTC work in ufshcd_remove() in the same order as ufshcd_init(); for the listed Ubuntu packages apply the referenced fixed versions such as php5 5.5.9+dfsg-1ubuntu4.19 or php7.0 7.0.8-0ubuntu0.16.04.1 and reboot.

How to confirm the fix worked

Confirm the presence of the cancel call inside ufshcd_remove() in the source, verify no RTC work remains scheduled after driver removal via workqueue inspection, and test module unload under load without observing the NULL dereference stack trace.

Typical attack path

1. Obtain local access or ability to trigger ufshcd_remove()
2. Unload or detach the UFS controller while RTC work is queued
3. Allow the workqueue to execute ufshcd_rtc_work after removal
4. Trigger NULL pointer dereference and kernel panic

How to detect it

Search kernel logs and dmesg for the exact stack trace containing ufshcd_rtc_work and _raw_spin_lock_irqsave after device removal events; review workqueue activity around ufshcd_remove calls.

What your security team should do

• Prioritize kernel updates on systems exposing UFS storage
• Audit custom or out-of-tree UFS drivers for similar lifetime issues
• Monitor for kernel oops involving ufshcd_rtc_work in logs