CVE-2024-26841
NoneCVSS
—
EPSS
0.2%
Published
Apr 17, 2024
CISA due date
—
Cloudanix analysis
A Linux kernel bug on certain processors could produce errors when extra CPU cores are turned off, possibly affecting overall system stability.
- Exploitation
- Local Privilege
- Attacker needs
- High Privilege
- Complexity
- High
- Impact
- Denial Of Service
- Component
- OS kernel
- Class
- Race Condition
- Remediation
- Upgrade
- Effort
- Medium
- Patch risk
- Low
What it actually does
Missing call to clear_cpu_sibling_map during non-boot CPU disable on LoongArch leaves cpu_sibling_map inconsistent, producing negative jump-label counts and warnings in __static_key_slow_dec_cpuslocked on SMT systems.
Why it matters to the business
Kernel warnings and potential instability during CPU hot-unplug on LoongArch SMT hardware can degrade reliability in servers or embedded systems using these processors; the issue is confined to the stable Linux kernel tree with no known ransomware use.
How an attack unfolds
An attacker with local privileges triggers repeated CPU offline operations via sysfs or hotplug interfaces on an SMT LoongArch system; the missing sibling-map update races with jump-label accounting and surfaces the warning path, though no public weaponization or threat-actor campaigns are recorded.
How to fix it
Upgrade the Linux kernel to commit b1ec3d6b86fdd057559a5908e6668279bf770e0e or any later stable tree revision that adds the clear_cpu_sibling_map definition and call site.
How to confirm the fix worked
Confirm the patch by checking for the clear_cpu_sibling_map function and its invocation inside the LoongArch CPU-hotplug disable path; re-test CPU offline on SMT hardware and verify absence of the jump-label warning.
Typical attack path
- Obtain local shell or container access on LoongArch SMT host
- Issue CPU offline via /sys/devices/system/cpu/cpuN/online
- Trigger sched_cpu_deactivate and cpuhp callbacks
- Observe jump-label negative-count warning in dmesg
How to detect it
Search kernel logs (dmesg, journalctl) for 'jump label: negative count!' and the accompanying WARNING stack trace containing __static_key_slow_dec_cpuslocked and cpuhp_thread_fun on LoongArch systems during CPU offline events.
- jump label: negative count!
- __static_key_slow_dec_cpuslocked+0xec/0x100
- cpuhp_invoke_callback
- smpboot_thread_fn
What your security team should do
- Apply the referenced kernel commit across all LoongArch deployments within the next maintenance window
- Add kernel log monitoring for 'jump label: negative count' strings
- Limit unprivileged CPU hotplug access via sysfs permissions until patched
The record
In the Linux kernel, the following vulnerability has been resolved: LoongArch: Update cpu_sibling_map when disabling nonboot CPUs Update cpu_sibling_map when disabling nonboot CPUs by defining & calling clear_cpu_sibling_map(), otherwise we get such errors on SMT systems: jump label: negative count! WARNING: CPU: 6 PID: 45 at kernel/jump_label.c:263 __static_key_slow_dec_cpuslocked+0xec/0x100 CPU: 6 PID: 45 Comm: cpuhp/6 Not tainted 6.8.0-rc5+ #1340 pc 90000000004c302c ra 90000000004c302c tp 90000001005bc000 sp 90000001005bfd20 a0 000000000000001b a1 900000000224c278 a2 90000001005bfb58 a3 900000000224c280 a4 900000000224c278 a5 90000001005bfb50 a6 0000000000000001 a7 0000000000000001 t0 ce87a4763eb5234a t1 ce87a4763eb5234a t2 0000000000000000 t3 0000000000000000 t4 0000000000000006 t5 0000000000000000 t6 0000000000000064 t7 0000000000001964 t8 000000000009ebf6 u0 9000000001f2a068 s9 0000000000000000 s0 900000000246a2d8 s1 ffffffffffffffff s2 ffffffffffffffff s3 90000000021518c0 s4 0000000000000040 s5 9000000002151058 s6 9000000009828e40 s7 00000000000000b4 s8 0000000000000006 ra: 90000000004c302c __static_key_slow_dec_cpuslocked+0xec/0x100 ERA: 90000000004c302c __static_key_slow_dec_cpuslocked+0xec/0x100 CRMD: 000000b0 (PLV0 -IE -DA +PG DACF=CC DACM=CC -WE) PRMD: 00000004 (PPLV0 +PIE -PWE) EUEN: 00000000 (-FPE -SXE -ASXE -BTE) ECFG: 00071c1c (LIE=2-4,10-12 VS=7) ESTAT: 000c0000 [BRK] (IS= ECode=12 EsubCode=0) PRID: 0014d000 (Loongson-64bit, Loongson-3A6000-HV) CPU: 6 PID: 45 Comm: cpuhp/6 Not tainted 6.8.0-rc5+ #1340 Stack : 0000000000000000 900000000203f258 900000000179afc8 90000001005bc000 90000001005bf980 0000000000000000 90000001005bf988 9000000001fe0be0 900000000224c280 900000000224c278 90000001005bf8c0 0000000000000001 0000000000000001 ce87a4763eb5234a 0000000007f38000 90000001003f8cc0 0000000000000000 0000000000000006 0000000000000000 4c206e6f73676e6f 6f4c203a656d616e 000000000009ec99 0000000007f38000 0000000000000000 900000000214b000 9000000001fe0be0 0000000000000004 0000000000000000 0000000000000107 0000000000000009 ffffffffffafdabe 00000000000000b4 0000000000000006 90000000004c302c 9000000000224528 00005555939a0c7c 00000000000000b0 0000000000000004 0000000000000000 0000000000071c1c ... Call Trace: [<9000000000224528>] show_stack+0x48/0x1a0 [<900000000179afc8>] dump_stack_lvl+0x78/0xa0 [<9000000000263ed0>] __warn+0x90/0x1a0 [<90000000017419b8>] report_bug+0x1b8/0x280 [<900000000179c564>] do_bp+0x264/0x420 [<90000000004c302c>] __static_key_slow_dec_cpuslocked+0xec/0x100 [<90000000002b4d7c>] sched_cpu_deactivate+0x2fc/0x300 [<9000000000266498>] cpuhp_invoke_callback+0x178/0x8a0 [<9000000000267f70>] cpuhp_thread_fun+0xf0/0x240 [<90000000002a117c>] smpboot_thread_fn+0x1dc/0x2e0 [<900000000029a720>] kthread+0x140/0x160 [<9000000000222288>] ret_from_kernel_thread+0xc/0xa4
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Debian:11 | linux | 0 | No fix |
| Debian:12 | linux | 0 | No fix |
| Debian:13 | linux | 0 | 6.7.7-1 |
| Linux | Kernel | 5.19.0 | 6.6.19 |
| Ubuntu:22.04:LTS | linux-aws-6.8 | 0 | 6.8.0-1009.9~22.04.2 |
| Ubuntu:22.04:LTS | linux-azure-6.8 | 0 | 6.8.0-1008.8~22.04.1 |
| Ubuntu:22.04:LTS | linux-gcp-6.8 | 0 | 6.8.0-1010.11~22.04.1 |
| Ubuntu:22.04:LTS | linux-hwe-6.8 | 0 | 6.8.0-38.38~22.04.1 |
| Ubuntu:22.04:LTS | linux-intel-iot-realtime | 0 | No fix |
| Ubuntu:22.04:LTS | linux-lowlatency-hwe-6.8 | 0 | 6.8.0-38.38.1~22.04.2 |
| Ubuntu:22.04:LTS | linux-nvidia-6.8 | 0 | 6.8.0-1008.8~22.04.1 |
| Ubuntu:22.04:LTS | linux-nvidia-tegra | 0 | No fix |
| Ubuntu:22.04:LTS | linux-nvidia-tegra-igx | 0 | No fix |
| Ubuntu:22.04:LTS | linux-oracle-6.8 | 0 | 6.8.0-1006.6~22.04.3 |
| Ubuntu:22.04:LTS | linux-realtime | 0 | No fix |
| Ubuntu:22.04:LTS | linux-riscv-6.8 | 0 | 6.8.0-38.38.1~22.04.1 |
| Ubuntu:24.04:LTS | linux-gkeop | 0 | 6.8.0-1001.3 |
| Ubuntu:24.04:LTS | linux-nvidia-lowlatency | 0 | 6.8.0-1009.9.1 |
| Ubuntu:24.04:LTS | linux-oem-6.11 | 0 | 6.11.0-1007.7 |
| Ubuntu:24.04:LTS | linux-oem-6.8 | 0 | 6.8.0-1003.3 |
| Ubuntu:24.04:LTS | linux-raspi-realtime | 0 | No fix |
| Ubuntu:24.04:LTS | linux-realtime | 0 | 6.8.0-1008.19 |
| Ubuntu:24.10 | linux-realtime | 0 | 6.11.0-1001.1 |
| Ubuntu:25.10 | linux-azure-fde | 0 | No fix |
| Ubuntu:Pro:20.04:LTS | linux-nvidia-tegra-5.15 | 0 | No fix |
| Ubuntu:Pro:22.04:LTS:Realtime:Kernel | linux-intel-iot-realtime | 0 | No fix |
| Ubuntu:Pro:22.04:LTS:Realtime:Kernel | linux-realtime | 0 | No fix |
| Ubuntu:Pro:24.04:LTS:Realtime:Kernel | linux-raspi-realtime | 0 | 6.8.0-2002.2 |
| Ubuntu:Pro:FIPS-preview:22.04:LTS | linux-aws-fips | 0 | No fix |
| Ubuntu:Pro:FIPS-preview:22.04:LTS | linux-azure-fips | 0 | No fix |
| Ubuntu:Pro:FIPS-preview:22.04:LTS | linux-fips | 0 | No fix |
| Ubuntu:Pro:FIPS-preview:22.04:LTS | linux-gcp-fips | 0 | No fix |
| Ubuntu:Pro:FIPS-updates:22.04:LTS | linux-aws-fips | 0 | No fix |
| Ubuntu:Pro:FIPS-updates:22.04:LTS | linux-azure-fips | 0 | No fix |
| Ubuntu:Pro:FIPS-updates:22.04:LTS | linux-fips | 0 | No fix |
| Ubuntu:Pro:FIPS-updates:22.04:LTS | linux-gcp-fips | 0 | No fix |
| Ubuntu:Pro:Realtime:24.04:LTS | linux-raspi-realtime | 0 | 6.8.0-2002.2 |
Related vulnerabilities
- CVE-2025-38562 In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix null… Also affects linux
- CVE-2025-38352 In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: fix… Also affects linux
- CVE-2025-22037 In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix null… Also affects linux
- CVE-2025-21760 In the Linux kernel, the following vulnerability has been resolved: ndisc: extend RCU… Also affects linux
- CVE-2025-21758 In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: add RCU… Also affects linux
- CVE-2025-21664 In the Linux kernel, the following vulnerability has been resolved: dm thin: make… Also affects linux
- CVE-2024-57946 In the Linux kernel, the following vulnerability has been resolved: virtio-blk: don't… Also affects linux
- CVE-2024-57945 In the Linux kernel, the following vulnerability has been resolved: riscv: mm: Fix the… Also affects linux