CVE-2024-49926: rcu-tasks: Fix access non-existent percpu rtpcp variable in rcu_tasks_need_gpcb()
In the Linux kernel, the following vulnerability has been resolved:
rcu-tasks: Fix access non-existent percpu rtpcp variable in rcutasksneedgpcb()
For kernels built with CONFIGFORCENRCPUS=y, the nrcpuids is defined as NRCPUS instead of the number of possible cpus, this will cause the following system panic:
smpboot: Allowing 4 CPUs, 0 hotplug CPUs ... setuppercpu: NRCPUS:512 nrcpumaskbits:512 nrcpuids:512 nrnodeids:1 ... BUG: unable to handle page fault for address: ffffffff9911c8c8 Oops: 0000 [#1] PREEMPT SMP PTI CPU: 0 PID: 15 Comm: rcutaskstrace Tainted: G W 6.6.21 #1 5dc7acf91a5e8e9ac9dcfc35bee0245691283ea6 RIP: 0010:rcutasksneedgpcb+0x25d/0x2c0 RSP: 0018:ffffa371c00a3e60 EFLAGS: 00010082 CR2: ffffffff9911c8c8 CR3: 000000040fa20005 CR4: 00000000001706f0 Call Trace: <TASK> ? die+0x23/0x80 ? pagefaultoops+0xa4/0x180 ? excpagefault+0x152/0x180 ? asmexcpagefault+0x26/0x40 ? rcutasksneedgpcb+0x25d/0x2c0 ? pfxrcutaskskthread+0x40/0x40 rcutasksonegp+0x69/0x180 rcutaskskthread+0x94/0xc0 kthread+0xe8/0x140 ? pfxkthread+0x40/0x40 retfromfork+0x34/0x80 ? pfxkthread+0x40/0x40 retfromforkasm+0x1b/0x80 </TASK>
Considering that there may be holes in the CPU numbers, use the maximum possible cpu number, instead of nrcpuids, for configuring enqueue and dequeue limits.
[ neeraj.upadhyay: Fix htmldocs build error reported by Stephen Rothwell ]
Other sources
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.25-1Fixed in 6.12.27-1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.64.2-9 - Upgrade
Upgrade
Linux kernel rcu-tasksto a version that resolves this vulnerability.Fixed in 6.6.21 #1 5dc7acf91a5e8e9ac9dcfc35bee0245691283ea6Patch rcu-tasks: Fix access non-existent percpu rtpcp variable in rcu_tasks_need_gpcb() - Configuration
For kernels built with CONFIG_FORCE_NR_CPUS=y (nr_cpu_ids defined as NR_CPUS instead of number of possible cpus), ensure the rcu-tasks fix is applied so rcu_tasks_need_gpcb() does not access the non-existent percpu rtpcp variable.
Linux kernel (percpu/RCU tasks) CONFIG_FORCE_NR_CPUS = enabled
Event History
Frequently Asked Questions
What is the severity of CVE-2024-49926?
CVE-2024-49926 is classified as a medium severity vulnerability due to potential stability impacts on Linux kernel systems.
How do I fix CVE-2024-49926?
To fix CVE-2024-49926, upgrade your Linux kernel to versions above 6.10.14 or between 6.11 and 6.11.3.
What systems are affected by CVE-2024-49926?
CVE-2024-49926 affects Linux kernel versions up to 6.10.14 and between 6.11 and 6.11.3.
What issue does CVE-2024-49926 address?
CVE-2024-49926 addresses an issue where non-existent percpu rtpcp variables are accessed in rcu_tasks_need_gpcb(), leading to possible system instabilities.
Is there a workaround for CVE-2024-49926?
There are no specific workarounds for CVE-2024-49926; the recommended action is to apply the kernel update.