Loading vulnerability…
CVE-2024-53194 is a use-after-free vulnerability in the Linux kernel PCI subsystem during hot removal. The pciehp driver creates a pci_slot that points to the downstream pci_bus without acquiring a reference to that bus. An apparent race between PCI hierarchy removal and driver binding can cause pciehp to bind after pci_stop_bus_device() completes, then unbind during pci_remove_bus_device() after the bus has already been destroyed. Subsequent access to slot->bus in pci_slot_release() dereferences freed memory. The defect was observed as a boot crash on recent Lenovo laptops connected to a USB4 dock, where a host-router reset during thunderbolt driver probing triggered dock hot removal.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
No public exploits tracked yet. Mallory keeps watching.
No public exploit code observed for this vulnerability.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A Linux kernel PCI hot-removal use-after-free caused by pci_slot retaining a pointer to pci_bus without acquiring a reference. A race between PCI hierarchy removal and driver binding can destroy the bus before the slot, causing invalid memory access. The reported manifestation is a boot crash on recent Lenovo laptops connected to a USB4 dock. The advisory assigns CVSS v3 severity High (7.8), with local access and low privileges required. The fix makes pci_create_slot() acquire a bus reference; the reporter could no longer reproduce the crash after this change. The Google COS advisory recommends updating sys-kernel/lakitu-kernel-6_1 and related packages to version 18613.164.4 or later.
Use-after-free during PCI hot removal in the Linux kernel.
A Linux kernel PCI use-after-free vulnerability caused by pci_slot retaining a pci_bus pointer without acquiring a reference. A race between driver binding and PCI device removal can destroy the bus before the slot, causing invalid memory access. The reported manifestation is a boot crash on recent Lenovo laptops connected to a USB4 dock. The advisory assigns a CVSS v3 base score of 7.8 and recommends updating Google's sys-kernel/lakitu-kernel-6_1 package to version 18244.291.3 or later.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.