CVE-2024-58093

What it actually does

Use-after-free in Linux kernel PCI/ASPM link state management: removing non-zero functions on a PCIe switch upstream port frees the parent link while it remains referenced by downstream ports, leading to invalid pointer dereference on subsequent access or hot-unplug.

Why it matters to the business

Kernel crashes and system instability during PCIe device removal or hot-unplug on affected Linux systems, increasing downtime risk for servers, embedded devices, and cloud workloads that rely on dynamic hardware reconfiguration.

How an attack unfolds

An attacker with local access or the ability to trigger PCIe hot-unplug (via pciehp or similar) removes functions on a multifunction switch upstream port in reverse order; this prematurely frees the ASPM link state still used by remaining ports, resulting in a GPF that may be turned into privilege escalation or denial of service.

How to fix it

Upgrade the Linux kernel to a version containing commit 0ff41df1cb268fc69e703a08a57ee14ae967d0ca (or equivalent backport) so that the ASPM link is freed exactly when function 0 is removed.

How to confirm the fix worked

Confirm the running kernel contains commit 0ff41df1cb268fc69e703a08a57ee14ae967d0ca; reproduce hot-unplug on PCIe switch hardware and verify absence of GPFs or use-after-free reports in dmesg.

Typical attack path

1. Obtain ability to trigger PCIe device removal or hot-unplug
2. Target a PCIe switch exposing MFD on the upstream port
3. Remove functions other than function 0 first
4. Trigger access to the now-freed ASPM parent_link during subsequent operations or remaining device removal
5. Cause kernel panic or exploit the dangling pointer for code execution

How to detect it

Inspect dmesg, syslog, and kernel crash dumps for GPFs or use-after-free messages referencing PCI/ASPM, pciehp, or link state during device removal operations; correlate with hot-unplug events.

• ASPM link state exit during switch upstream function removal
• pciehp.*reverse order
• downstream would point to free'd memory
• GPF.*PCI/ASPM

What your security team should do

• Apply the fixed kernel version immediately on systems supporting PCIe hotplug or multifunction switches
• Prioritize updates for production servers and cloud instances where device removal paths exist
• Monitor kernel logs for ASPM-related panics until patches are deployed