CVE-2024-56764

What it actually does

Use-after-free in ublk_abort_requests() when add_disk() fails, causing reference to a freed gendisk during request abort on uring exit or timeout.

Why it matters to the business

Kernel-level memory corruption on affected Linux systems can lead to crashes, denial of service, or potential privilege escalation, disrupting operations and increasing breach risk.

How an attack unfolds

An attacker triggers a failure path in add_disk() for a ublk device, then forces ublk_abort_requests() execution (via uring context exit or timeout handling) to dereference the now-freed gendisk structure.

How to fix it

Apply the kernel fix that detaches gendisk on add_disk() failure; for listed chromium-browser packages on Ubuntu 14.04 LTS upgrade to 53.0.2785.143-0ubuntu0.14.04.1.1142 or later.

How to confirm the fix worked

Confirm kernel source contains the detach logic after add_disk() failure; verify package versions match the supplied fixed revisions and test ublk device creation under failure conditions.

Typical attack path

1. Cause add_disk() to fail for a ublk device
2. Trigger ublk_abort_requests() via uring exit or timeout
3. Access the freed gendisk reference to corrupt kernel memory

How to detect it

Review kernel logs for ublk abort paths coinciding with add_disk failures; inspect crash dumps for gendisk UAF patterns.

What your security team should do

• Prioritize kernel updates on all systems exposing ublk devices
• Monitor for ublk-related crashes or unexpected reboots
• Apply the exact chromium-browser fixed package versions where applicable