CVE-2024-27055

What it actually does

Calling cpumask_test_cpu() with invalid CPU value -1 in wq_update_node_max_active() triggers invalid memory access during workqueue attribute application or early kernel init, resulting in paging fault, kernel oops, and panic.

Why it matters to the business

Systems may crash during boot or when workqueues are allocated, causing unplanned downtime and requiring manual intervention or reboots on affected Linux kernels.

How an attack unfolds

The bug is triggered automatically during kernel initialization or apply_wqattrs_commit when no CPU is going offline; no attacker action is required as the -1 value is passed internally leading to the fault.

How to fix it

Upgrade the Linux kernel package to version 6.7.12-1 or later on Debian 13 systems; apply the upstream fix that guards the cpumask_test_cpu call against -1.

How to confirm the fix worked

Verify running kernel version is at least 6.7.12-1; confirm absence of the wq_update_node_max_active+0x50 crash signature in dmesg after boot or workqueue allocation.

Typical attack path

1. Kernel boot or workqueue creation invokes alloc_workqueue
2. apply_workqueue_attrs_locked calls apply_wqattrs_commit
3. wq_update_node_max_active receives off_cpu=-1
4. cpumask_test_cpu(-1) dereferences invalid address
5. Kernel oops and panic occur

How to detect it

Search kernel logs and dmesg for the exact call trace starting with wq_update_node_max_active+0x50/0x1fc and the paging request at ffff0002100296e0 or similar arch-specific addresses; also look for 'Kernel panic - not syncing: Attempted to kill the idle task'.

• wq_update_node_max_active+0x50/0x1fc
• Unable to handle kernel paging request at virtual address ffff0002100296e0
• Kernel panic - not syncing: Attempted to kill the idle task
• pc : wq_update_node_max_active+0x50/0x1fc

What your security team should do

• Prioritize kernel package upgrade to 6.7.12-1 across all Debian 13 deployments
• Monitor for kernel panic logs containing wq_update_node_max_active during next reboot cycle
• Test workqueue-heavy workloads after patching to confirm stability