CVE-2024-26646: thermal: intel: hfi: Add syscore callbacks for system-wide PM

Published Mar 26, 2024
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

thermal: intel: hfi: Add syscore callbacks for system-wide PM

The kernel allocates a memory buffer and provides its location to the hardware, which uses it to update the HFI table. This allocation occurs during boot and remains constant throughout runtime.

When resuming from hibernation, the restore kernel allocates a second memory buffer and reprograms the HFI hardware with the new location as part of a normal boot. The location of the second memory buffer may differ from the one allocated by the image kernel.

When the restore kernel transfers control to the image kernel, its HFI buffer becomes invalid, potentially leading to memory corruption if the hardware writes to it (the hardware continues to use the buffer from the restore kernel).

It is also possible that the hardware "forgets" the address of the memory buffer when resuming from "deep" suspend. Memory corruption may also occur in such a scenario.

To prevent the described memory corruption, disable HFI when preparing to suspend or hibernate. Enable it when resuming.

Add syscore callbacks to handle the package of the boot CPU (packages of non-boot CPUs are handled via CPU offline). Syscore ops always run on the boot CPU. Additionally, HFI only needs to be disabled during "deep" suspend and hibernation. Syscore ops only run in these cases.

[ rjw: Comment adjustment, subject and changelog edits ]

Other sources

In the Linux kernel, the following vulnerability has been resolved:

thermal: intel: hfi: Add syscore callbacks for system-wide PM

The Linux kernel CVE team has assigned CVE-2024-26646 to this issue.

Upstream advisory: https://lore.kernel.org/linux-cve-announce/20240326175007.1388794-14-lee@kernel.org/T

— Red Hat

Affected Software

11 affected componentsFixes available
Linux Linux kernel<6.1.76
Linux Linux kernel>=6.2<6.6.15
Linux Linux kernel>=6.7<6.7.3
redhat/kernel<6.1.76
6.1.76
redhat/kernel<6.6.15
6.6.15
redhat/kernel<6.7.3
6.7.3
redhat/kernel<6.8
6.8
debian/linux<6.1.76-1
6.1.76-1
debian/linux<6.6.15-1
6.6.15-1
debian/linux<6.6.15-1
6.6.15-1
debian/linux
6.1.176-16.1.190-16.12.107-16.12.115-27.2.12-17.2.15-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade debian/linux to a version that resolves this vulnerability.

    Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1
  2. Upgrade

    Upgrade redhat/kernel to a version that resolves this vulnerability.

    Fixed in 6.1.76
  3. Upgrade

    Upgrade redhat/kernel to a version that resolves this vulnerability.

    Fixed in 6.6.15
  4. Upgrade

    Upgrade redhat/kernel to a version that resolves this vulnerability.

    Fixed in 6.7.3
  5. Upgrade

    Upgrade redhat/kernel to a version that resolves this vulnerability.

    Fixed in 6.8
  6. Configuration

    Apply the kernel change to disable HFI when preparing to suspend or hibernate (including “deep” suspend and hibernation), and re-enable HFI when resuming. The fix adds syscore callbacks so the required syscore ops run on the boot CPU and only in these PM cases to prevent memory corruption (CVE-2024-26646).

    Linux kernel (thermal: intel: hfi) HFI state during system-wide power management = disabled during suspend/hibernate; enabled on resume

Event History

Mar 26, 2024
CVE Published
via MITRE·05:50 PM
Data Sourced
via MITRE·05:50 PM
DescriptionSeverity
Data Sourced
via NVD·06:15 PM
RemedyDescriptionSeverityWeaknessAffected Software
Data Sourced
via OSV·06:15 PM
DescriptionSeverityAffected Software
Mar 27, 2024
Data Sourced
via Red Hat·11:15 AM
DescriptionSeverityAffected Software

Frequently Asked Questions

1

What is the severity of CVE-2024-26646?

The severity of CVE-2024-26646 is currently classified as moderate.

2

How do I fix CVE-2024-26646?

To fix CVE-2024-26646, update to the appropriate kernel version, ensuring it is patched to 6.1.76, 6.6.15, 6.7.3, or 6.8 for Red Hat or to 6.1.123-1, 6.1.119-1, 6.12.10-1, or 6.12.11-1 under Debian.

3

Which Linux kernel versions are affected by CVE-2024-26646?

CVE-2024-26646 affects various kernel versions, specifically those prior to 6.1.76, 6.6.15, 6.7.3, 6.8 for Red Hat, and up to 5.10.226-1 for Debian.

4

Is CVE-2024-26646 exploited in the wild?

As of now, there are no confirmed reports of CVE-2024-26646 being actively exploited in the wild.

5

What is the nature of the vulnerability CVE-2024-26646?

CVE-2024-26646 is a vulnerability in the Linux kernel related to improper memory allocation for hardware communication.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203