CVE-2024-56712

What it actually does

Memory leak in the udmabuf driver where export_udmabuf() leaves a dma_buf object containing a dangling pointer when dma_buf_fd() fails due to a full FD table; the leak originates from error handling in udmabuf_create() that does not release the dma_buf.

Why it matters to the business

Gradual memory exhaustion on Linux systems that use udmabuf, potentially causing reduced performance or out-of-memory conditions under sustained load; low immediate risk given the low EPSS score and lack of known exploitation or ransomware use.

How an attack unfolds

An attacker with local access triggers repeated failures in dma_buf_fd() inside export_udmabuf() by exhausting the process FD table before calling the export path, accumulating leaked dma_buf objects over time; no named threat actors are known to exploit this path.

How to fix it

Update the Linux kernel to a version containing commit c9fc8428d4255c2128da9c4d5cd92e554d0150cf or later; for affected Ubuntu packages apply the listed fixes (potrace 1.13-2 on 16.04 LTS and 1.14-2 on 18.04 LTS) and reboot affected systems.

How to confirm the fix worked

Confirm the running kernel contains commit c9fc8428d4255c2128da9c4d5cd92e554d0150cf, verify udmabuf export error paths no longer leak dma_buf objects via code review or memory-leak testing, and monitor kernel memory statistics before and after the change.

Typical attack path

1. Obtain local execution on a Linux system using udmabuf
2. Fill the file descriptor table to force dma_buf_fd() failure
3. Invoke export_udmabuf() repeatedly to trigger the leaking error path
4. Observe gradual increase in kernel memory usage without corresponding user-space objects

How to detect it

Review kernel memory statistics and slab allocator usage for unexpected growth in dma_buf objects; examine system call traces involving udmabuf export under high file-descriptor load; no public indicators of active exploitation exist.

What your security team should do

• Apply the kernel patch containing c9fc8428d4255c2128da9c4d5cd92e554d0150cf at the next scheduled maintenance window
• Prioritize systems that heavily use udmabuf or DMA buffer exports
• Add kernel memory usage monitoring for udmabuf-related allocations
• Review any downstream dependents of the affected kernel tree for coordinated updates