CVE-2024-56748

What it actually does

In the Linux kernel qedf driver, failure of qed_ops->common->sb_init leaves DMA memory allocated via sb_virt unreleased because the error path omits dma_free_coherent.

Why it matters to the business

Systems using the qedf SCSI driver may experience gradual memory exhaustion, leading to degraded performance, instability, or eventual service disruption on affected Linux hosts.

How an attack unfolds

An attacker triggers repeated allocation failures in qedf_alloc_and_init_sb() to induce the leak; threat actors noted in Linux kernel campaigns could combine this with other resource-exhaustion techniques to amplify impact on storage subsystems.

How to fix it

Update the Linux kernel to a version containing the fix that adds dma_free_coherent() in the error path of qedf_alloc_and_init_sb(), matching the approach used in qedr_alloc_mem_sb() and qede_alloc_mem_sb().

How to confirm the fix worked

Confirm the patched kernel source contains the dma_free_coherent() call on the sb_init failure path and verify no memory leak is reported under the same error conditions.

Typical attack path

1. Identify hosts running vulnerable qedf driver
2. Trigger conditions that cause sb_init to fail
3. Repeat to accumulate leaked DMA buffers
4. Monitor for system memory pressure or OOM events

How to detect it

Review kernel logs for repeated qedf allocation failures, monitor DMA memory usage patterns on qedf-enabled hosts, and correlate with any observed gradual memory growth without corresponding workload increase.

What your security team should do

• Prioritize kernel updates on systems exposing the qedf driver
• Monitor EPSS trend and any new exploitation reports given noted Linux kernel campaigns
• Audit for downstream dependents that ship this driver code