CVE-2024-26705

What it actually does

Write attempt to a __ro_after_init-marked btlb_info struct during static BTLB entry setup on 32-bit PA-RISC CPU hotplug triggers a kernel segmentation fault due to missing write permissions.

Why it matters to the business

PA-RISC systems using CPU hotplug may experience unexpected kernel crashes on 32-bit processors, reducing system availability and complicating hardware scaling or maintenance operations.

How an attack unfolds

An attacker or automated process triggers a CPU hotplug bringup event on an affected 32-bit PA-RISC system; the kernel attempts to populate the static btlb_info structure but faults because the structure is protected read-only after init, resulting in a crash.

How to fix it

Apply the fix present in commit 54944f45470af5965fb9c28cf962ec30f38a8f5b, which removes the __ro_after_init annotation from the btlb_info structure; rebuild and deploy the updated kernel.

How to confirm the fix worked

Confirm the commit hash appears in the running kernel source tree; exercise CPU hotplug bringup on 32-bit PA-RISC hardware and verify no segmentation fault occurs during BTLB initialization.

Typical attack path

1. Identify Linux kernel running on PA-RISC hardware with CPU hotplug enabled
2. Initiate a 32-bit CPU bringup event
3. Kernel executes BTLB setup code that writes to the ro_after_init struct
4. Processor generates a segmentation fault and the system crashes or panics

How to detect it

Review kernel logs for segmentation faults or oops messages referencing BTLB or btlb_info during CPU online events on parisc; correlate with hotplug activity in dmesg or syslog around the time of the crash.

What your security team should do

• Patch all affected Linux kernels to the fixed commit at the earliest maintenance window
• Restrict CPU hotplug operations on unpatched 32-bit PA-RISC systems until updated
• Include parisc architecture in regular kernel update testing and validation cycles