CVE-2024-41087 Overview
CVE-2024-41087 is a double free vulnerability [CWE-415] in the Linux kernel's libata-core subsystem. The flaw exists in the ata_host_alloc() function, where an error path can trigger kfree(host) twice. When ata_port_alloc() fails inside ata_host_alloc(), execution jumps to the err_out label, which calls devres_release_group(). That call invokes ata_host_release(), which already frees the host structure via kfree(). The subsequent direct kfree(host) in ata_host_alloc() triggers a kernel BUG at mm/slub.c:553. The defect affects the Advanced Host Controller Interface (AHCI) initialization path on Linux systems.
Critical Impact
Local attackers with low privileges can trigger memory corruption in the kernel, leading to denial of service or potential privilege escalation on affected Linux systems.
Affected Products
- Linux Kernel (multiple stable branches prior to fix commits)
- Debian LTS distributions (addressed in January 2025 advisory)
- Systems using the AHCI/libata storage driver stack
Discovery Timeline
- 2024-07-29 - CVE-2024-41087 published to NVD
- 2025-11-03 - Last updated in NVD database
Technical Details for CVE-2024-41087
Vulnerability Analysis
The defect resides in the SATA library core (libata-core) of the Linux kernel. During host adapter initialization, ata_host_alloc() allocates a host structure and opens a devres group to track child allocations such as ATA ports. If ata_port_alloc() fails partway through, the function takes the err_out branch.
The err_out path calls devres_release_group(), which walks the device resource list and invokes registered release callbacks. One of those callbacks is ata_host_release(), which calls kfree(host) on the host structure. The function then continues and executes kfree(host) a second time directly, freeing memory that was already returned to the slab allocator.
The call trace observed on kernel 6.10.0-rc5 shows the second free triggering an invalid opcode exception inside the SLUB allocator at mm/slub.c:553, originating from ahci_init_one() → ata_host_alloc_pinfo() → ata_host_alloc().
Root Cause
The root cause is incorrect cleanup ordering. The devres framework registered the host release callback, so the host buffer is freed automatically when the group is released. The explicit kfree(host) in the error path duplicates that work, creating a classic double free condition [CWE-415].
Attack Vector
Exploitation requires local access with low privileges. An attacker who can trigger AHCI driver initialization failure, for example via crafted device events or constrained memory allocations, can force the error path and corrupt slab metadata. Successful corruption leads to kernel panic at minimum and may enable privilege escalation through SLUB exploitation techniques.
No public proof-of-concept exploit is currently available, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS probability is 0.012%, indicating low predicted exploitation likelihood.
The fix moves the kfree(host) call so it only executes when devres_open_group() itself failed and no release callback was registered. Technical details are available in the Linux Kernel Commit ab9e0c5.
Detection Methods for CVE-2024-41087
Indicators of Compromise
- Kernel oops or panic messages referencing kfree+0x2cf/0x2f0 with a call trace including ata_host_alloc and ahci_init_one.
- kernel BUG at mm/slub.c:553 entries in dmesg or /var/log/kern.log during boot or hot-plug events.
- Unexpected AHCI driver load failures followed by system instability.
Detection Strategies
- Inventory running kernel versions against the fixed commits listed in the kernel.org stable tree and your distribution's security tracker.
- Enable kernel address sanitizer (KASAN) in test environments to surface double free conditions early.
- Monitor systemd journal and kernel ring buffer for SLUB allocator faults correlated with libata or AHCI subsystem activity.
Monitoring Recommendations
- Centralize kernel logs and alert on BUG, Oops, and invalid opcode strings tied to libata or ahci modules.
- Track unplanned reboots on storage-heavy hosts where AHCI initialization runs at boot.
- Audit kernel package versions across the fleet on a scheduled cadence to detect drift from patched baselines.
How to Mitigate CVE-2024-41087
Immediate Actions Required
- Apply the latest stable kernel update from your Linux distribution that incorporates the libata-core double free fix.
- For Debian systems, install the kernel package referenced in the Debian LTS Announcement January 2025.
- Restrict local account access on multi-tenant systems until the patch is deployed.
- Reboot affected hosts after kernel updates to load the corrected libata module.
Patch Information
The upstream fix is distributed across multiple stable branches. Relevant commits include 010de9a, 062e256, 290073b, 56f1c7e, 5dde5f8, 702c1ed, 8106da4, and ab9e0c5. Use your distribution's package manager to install the appropriate updated kernel.
Workarounds
- No reliable runtime workaround exists; the defect lives in driver initialization code that executes during boot and device probe.
- Where patching is delayed, limit physical and local logical access to reduce the attack surface for triggering the error path.
- Avoid loading custom or out-of-tree AHCI drivers that may exercise the vulnerable path.
# Verify the running kernel version and update on Debian/Ubuntu
uname -r
sudo apt update && sudo apt install --only-upgrade linux-image-$(uname -r | sed 's/.*-//')
sudo reboot
# Verify the running kernel version and update on RHEL/Fedora
uname -r
sudo dnf update kernel
sudo reboot
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
