CVE-2024-56652

What it actually does

Use-after-free in xe_reg_sr_apply_mmio triggered when krealloc relocates the register pool memory, invalidating xarray pointers that are later dereferenced.

Why it matters to the business

Kernel crashes or potential local privilege escalation on systems running affected Linux kernels with Xe graphics hardware, requiring urgent patching to maintain stability and security.

How an attack unfolds

An attacker with local access loads the xe driver and triggers register pool reallocation; the subsequent memory move leaves stale xarray entries that cause a use-after-free when MMIO registers are applied.

How to fix it

Upgrade the Linux kernel to a version containing commit b0193a31a0ca5a0f9e60bb4a86537d46b98111b8 or later; rebuild and reboot with the fixed kernel. For Ubuntu packages, apply the corresponding fixed libgd2 updates listed in the advisory if the system uses those backports.

How to confirm the fix worked

Verify the running kernel contains commit b0193a31a0ca5a0f9e60bb4a86537d46b98111b8, confirm absence of the KASAN slab-use-after-free report in xe_reg_sr_apply_mmio, and test driver initialization under memory-pressure conditions that previously triggered krealloc relocation.

Typical attack path

1. Obtain local code execution on the target system
2. Load or trigger the drm/xe driver module
3. Force repeated register pool allocations until krealloc moves the backing buffer
4. Invoke xe_reg_sr_apply_mmio to dereference the now-invalid xarray entries
5. Exploit the resulting use-after-free for denial of service or privilege escalation

How to detect it

Inspect kernel logs for KASAN reports referencing xe_reg_sr_apply_mmio and slab-use-after-free; correlate with modprobe or graphics driver initialization events around the time of the crash.

What your security team should do

• Prioritize kernel upgrades on all systems exposing Xe graphics hardware within the next maintenance window
• Monitor for local privilege-escalation attempts targeting graphics drivers until patches are deployed
• Remove unnecessary local user accounts and restrict module loading where feasible