CVE-2024-27006

What it actually does

Missing increment of the count field in struct trip_stats inside thermal_debug_tz_trip_up() allows division by zero during average temperature computation in thermal debugfs, resulting in kernel panic.

Why it matters to the business

Unexpected system crashes or reboots on Linux kernels 6.8 and later that use thermal zone monitoring, leading to downtime and potential data loss in servers, embedded devices, and cloud workloads; low exploit likelihood but high operational impact until patched.

How an attack unfolds

An attacker or environmental condition triggers repeated temperature crossings of trip points; the first crossing leaves count at zero, and subsequent average-temperature calculations in debugfs code divide by that zero, crashing the kernel. No remote code execution is possible.

How to fix it

Update the Linux kernel to a version containing commit 9c8215d32e730b597c809a9d2090bf8ec1b79fcf or later; rebuild and reboot all affected systems. No configuration workaround exists.

How to confirm the fix worked

Verify the running kernel contains commit 9c8215d32e730b597c809a9d2090bf8ec1b79fcf via git log or uname output; confirm thermal debugfs no longer triggers divide-by-zero on trip crossings.

Typical attack path

1. Trigger thermal zone temperature to cross a trip point upward for the first time
2. Invoke thermal_debug_tz_trip_up() before trips_crossed[] is updated
3. Cause division by zero in average temperature calculation
4. Kernel panic and system crash

How to detect it

Search kernel logs for thermal debugfs divide-by-zero oops or panic messages referencing thermal_debug_tz_trip_up; no network or user-space artifacts are produced.

What your security team should do

• Prioritize kernel upgrade on all production Linux systems within normal change windows
• Monitor vendor advisories for backported fixes in distribution kernels
• Test thermal workloads in staging before deploying patched kernels