CVE-2024-27005

What it actually does

Race condition in Linux kernel interconnect subsystem where icc_node::req_list can be modified under icc_lock while icc_set_bw() iterates it under only icc_bw_lock, resulting in invalid pointer dereference during aggregate_requests().

Why it matters to the business

Linux-based systems may experience kernel crashes or instability when interconnect bandwidth operations occur concurrently with path allocation or release, potentially disrupting services on affected devices and requiring reboots or updates.

How an attack unfolds

An attacker with local access triggers concurrent calls to icc_set_bw(), of_icc_get(), and icc_put() from multiple threads or processes to race on req_list manipulation, causing the hlist iterator to encounter an invalid pointer and crash the kernel.

How to fix it

Update the Linux kernel to a version containing commit c9c3395d5e3dcc6daee66c6908354d47bf98cb0c or later that ensures icc_bw_lock protects all req_list modifications.

How to confirm the fix worked

Verify the running kernel contains the fix commit; confirm absence of the described locking split issues via code review or by running targeted concurrency tests on interconnect paths.

Typical attack path

1. Obtain local code execution on a Linux system using the interconnect framework.
2. Spawn threads that simultaneously invoke bandwidth setting and path get/put operations.
3. Trigger the race window between icc_bw_lock and icc_lock to corrupt req_list traversal.
4. Cause kernel panic via invalid pointer dereference.

How to detect it

Review kernel logs for oops/panic traces referencing icc_set_bw, aggregate_requests, hlist_for_each_entry, or interconnect locking; inspect for crashes during of_icc_get or icc_put activity.

What your security team should do

• Prioritize kernel upgrades to the fixed commit on all production Linux systems.
• Monitor for kernel oops or panic reports involving interconnect or icc functions.
• Apply updates within standard patch cycles given low EPSS and no known exploitation.