CVE-2024-26686

What it actually does

Excessive spinning with interrupts disabled in do_task_stat() when many threads concurrently gather per-process thread/children statistics under lock_task_sighand(), leading to hard lockups on systems with high thread counts.

Why it matters to the business

Local workloads that frequently read /proc/<pid>/stat or equivalent interfaces can trigger system-wide hangs or forced reboots on Linux hosts, causing service outages and requiring kernel updates across fleets.

How an attack unfolds

A local attacker launches many threads that simultaneously invoke do_task_stat() against a target process possessing a large number of threads; the repeated acquisition of sighand lock with IRQs disabled causes CPU spin exceeding watchdog thresholds and a hard lockup.

How to fix it

Upgrade the Linux kernel to a version containing commit 4fe85bdaabd63f8f8579b24a10ed597c9c482164 or later; rebuild and reboot all affected hosts; apply vendor-supplied backports for supported distribution kernels.

How to confirm the fix worked

Confirm the running kernel contains commit 4fe85bdaabd63f8f8579b24a10ed597c9c482164 via 'git log' or package version checks; monitor for absence of hard lockup reports under synthetic load that previously reproduced the spin condition.

Typical attack path

1. Obtain local unprivileged access on a Linux system
2. Create or identify a process with a large thread count
3. Spawn many concurrent threads that each read /proc/<pid>/stat repeatedly
4. Trigger prolonged spin under lock_task_sighand() until watchdog fires

How to detect it

Search kernel logs for hard lockup or NMI watchdog messages referencing do_task_stat or sighand; correlate spikes in /proc filesystem reads with lockup events; examine audit or system call logs for repeated stat-related activity from the same user.

What your security team should do

• Prioritize kernel updates on multi-threaded servers and containers within the next maintenance window
• Add monitoring for hard lockup events and excessive /proc reads in production workloads
• Review and limit untrusted local code that enumerates process statistics at high frequency