CPU State Handling Vulnerability in Linux Kernel by The Linux Foundation

CVE-2024-57951

Summary

A vulnerability exists within the Linux kernel's handling of CPU states during hotplug operations. This issue arises when a CPU transitions through various states, particularly from online to unplugged and back. The hrtimers_prepare_cpu() function fails to execute, resulting in the hrtick being incorrectly assumed as active, which can lead to the clockevent device becoming permanently stuck in a mode that hampers its functionality. Additionally, the CPU's online state may not be properly reset, causing potential instability with dangling pointers. To mitigate this risk, a callback mechanism has been introduced to properly reset the CPU state and ensure consistent behavior during hotplug processes.

References