CVE-2024-31076

What it actually does

A race in x86 vector management during CPU offline allows apicd->prev_vector to remain allocated in vector_matrix when irq_force_complete_move is skipped and __vector_schedule_cleanup only resets flags; the leak occurs because the old vector is never reclaimed if the outgoing CPU is not currently affine to the interrupt.

Why it matters to the business

Prolonged operation on systems that frequently offline CPUs can exhaust limited per-CPU interrupt vectors, leading to inability to assign new interrupts and eventual denial of service; the issue affects long-running Linux deployments that rely on CPU hotplug.

How an attack unfolds

An attacker with local access repeatedly triggers CPU offline/online cycles while an interrupt is being moved; the timing window prevents reclamation of the previous vector, gradually depleting the vector space until new interrupt allocation fails.

How to fix it

Apply the upstream fix in commit a40209d355afe4ed6d533507838c9e5cd70a76d8 or later; for RHEL 6 systems update dhclient, dhcp, dhcp-common and related packages to version 12:4.1.1-53.P1.el6_9.3 or newer; disable unnecessary CPU hotplug if the kernel cannot be updated.

How to confirm the fix worked

Confirm the running kernel contains commit a40209d or verify package versions match the listed fixed releases; monitor /proc/interrupts and vector allocation counters for unexpected growth after CPU offline events.

Typical attack path

1. Obtain local unprivileged access on a Linux system supporting CPU hotplug
2. Trigger repeated CPU offline events while an interrupt affinity change is pending
3. Force the race condition so irq_force_complete_move is bypassed
4. Accumulate unreclaimed vectors until vector_matrix exhaustion occurs
5. Cause system-wide failure to deliver new interrupts or degrade performance

How to detect it

Inspect kernel logs for vector allocation warnings or failures around CPU hot-unplug events; look for repeated messages referencing irq_move_irq or vector_cleanup on systems that perform CPU offline operations.

What your security team should do

• Prioritize patching kernel or affected dhcp packages on any system that performs CPU hotplug
• Review workloads that frequently online/offline CPUs for exposure
• Add monitoring for vector allocation failures in production kernels
• Test the fix in staging environments that exercise CPU hotplug paths