CVE-2024-26894

What it actually does

Memory leak of 1024-byte objects allocated during acpi_processor_power_init that are never freed after acpi_processor_power_exit unregisters the CPU idle device.

Why it matters to the business

Repeated CPU idle device registration and unregistration on affected Linux systems gradually exhausts kernel memory, degrading performance and risking denial of service on long-running servers or embedded devices.

How an attack unfolds

An attacker with local root privileges triggers repeated ACPI processor start and exit paths, such as through CPU hotplug or driver reload sequences, causing the kernel to allocate but never release the idle device structures until memory pressure leads to system instability.

How to fix it

Upgrade the Linux kernel to a version containing commit d351bcadab6caa6d8ce7159ff4b77e2da35c09fa which frees the CPU idle device after unregistering it in acpi_processor_power_exit.

How to confirm the fix worked

Confirm the running kernel includes the referenced commit or later; monitor slabinfo or kmemleak reports for absence of the 1024-byte unreferenced objects associated with acpi_processor_power_init after device exit.

Typical attack path

1. Obtain local root or high-privilege access on a Linux system using ACPI processor idle.
2. Trigger CPU idle device initialization and subsequent exit paths repeatedly.
3. Observe gradual consumption of unreferenced kernel memory objects.
4. Induce memory pressure to degrade or crash the system.

How to detect it

Inspect kernel logs and slab allocator statistics for repeated allocations from acpi_processor_power_init without corresponding frees; use kmemleak or similar tools to identify unreferenced 1024-byte objects allocated during early boot or CPU initialization.

What your security team should do

• Prioritize kernel updates on all production Linux systems within the next maintenance window.
• Enable kernel memory leak detectors such as kmemleak in test environments to validate the fix.
• Review ACPI and CPU idle configurations for unnecessary hotplug or driver reload activity.