CVE-2024-26975

What it actually does

NULL pointer dereference in intel_rapl MMIO driver probe when rp->priv->rapl_defaults remains unset on CPUs absent from the model list, resulting in a kernel crash during module initialization.

Why it matters to the business

Unexpected system crashes or boot failures on affected hardware can interrupt operations, require manual recovery, and increase downtime for systems relying on the affected kernel components.

How an attack unfolds

An attacker with local access loads or triggers the intel_rapl MMIO driver on a platform whose CPU ID is missing from the intel_rapl_common list; the missing sanity check allows the NULL defaults pointer to be dereferenced during RAPL framework registration, causing a kernel panic.

How to fix it

Update to a fixed kernel that includes the sanity check ensuring rp->priv->rapl_defaults is always valid; for the spinnaker/rosco package apply commit e80cfaa1abfb3a0e9026d45d6027291bfb815daf or later.

How to confirm the fix worked

Verify the presence of the sanity check in the intel_rapl probe code and confirm that systems with unlisted CPU IDs no longer panic on driver load; test probe on both supported and unsupported CPU models.

Typical attack path

1. Obtain local access to a system running the vulnerable kernel
2. Ensure the MMIO RAPL driver is probed (via module load or boot on unsupported CPU)
3. Trigger the probe path that skips CPUID match but leaves defaults unset
4. Cause NULL dereference and kernel panic

How to detect it

Inspect kernel logs (dmesg, /var/log/kern.log, journalctl) for NULL pointer dereference oops or panic messages occurring during intel_rapl or powercap module initialization; correlate timestamps with boot or driver-load events.

What your security team should do

• Apply the kernel fix or package update containing commit e80cfaa1abfb3a0e9026d45d6027291bfb815daf immediately on all affected systems
• Prioritize patching for production workloads that may encounter the driver during boot
• Monitor kernel logs for oops/panic entries referencing intel_rapl after updates