CVE-2024-35801

What it actually does

Out-of-sync xfd_state per-CPU cache and MSR_IA32_XFD after CPU hotplug allows subsequent xfd_update_state() calls to skip required MSR writes, resulting in XRSTOR raising #NM exceptions inside kernel context and crashing the kernel.

Why it matters to the business

Unexpected kernel crashes on systems performing CPU hotplug (virtualization hosts, cloud instances, laptops with power management) cause service outages and require reboots; high local impact but low remote exploitability keeps overall risk moderate.

How an attack unfolds

An attacker with local access triggers CPU offline/online events while arranging FPU state changes so that xfd_update_state() skips the MSR write; the resulting XRSTOR #NM in kernel space panics the system. The listed Android kernel RCE actor context indicates possible interest in similar kernel stability flaws for privilege escalation chains.

How to fix it

Apply the fix present in commit 21c7c00dae55cb0e3810d5f9506b58f68475d41d or later stable kernels; rebuild and reboot all affected systems. No temporary mitigation is available; disable CPU hotplug where feasible as a short-term control.

How to confirm the fix worked

Confirm the running kernel source contains commit 21c7c00dae55cb0e3810d5f9506b58f68475d41d or verify xfd_set_state() is used for all MSR_IA32_XFD writes; re-test CPU hotplug under FPU state changes to ensure no #NM occurs.

Typical attack path

1. Obtain local code execution on target Linux system
2. Trigger CPU hotplug via power management, virtualization, or sysfs
3. Manipulate extended feature enablement to invoke xfd_update_state()
4. Cause XRSTOR to fault with #NM in kernel mode
5. Kernel panic terminates all processes on the CPU

How to detect it

Search kernel logs and dmesg for XRSTOR #NM faults, FPU state machine errors, or oops following CPU hotplug events; correlate with auditd or systemd logs showing CPU offline/online activity on systems running vulnerable kernels.

What your security team should do

• Patch all Linux kernels to the fixed commit within 30 days given 880 days of public exposure
• Monitor kernel logs for unexpected #NM and FPU-related oops on production hosts
• Prioritize patching of virtualization hosts and Android-derived kernels due to listed threat actor interest
• Review downstream package builds that consume the stable tree for inclusion of the fix