CVE-2024-35989

What it actually does

The idxd driver registers a perf_event_cpu_offline callback that attempts perf_pmu_migrate_context during driver removal; on single-CPU platforms the migration target is invalid, causing a page fault inside mutex_lock during the cpuhp callback.

Why it matters to the business

Unloading the idxd driver on single-CPU systems produces a kernel oops, resulting in system instability, potential loss of in-flight DMA work, and unplanned downtime until reboot.

How an attack unfolds

An attacker with local root privileges loads the idxd driver if necessary, then executes rmmod; the offline callback path is taken on the single online CPU and the invalid migration attempt triggers the oops.

How to fix it

Upgrade the Linux kernel to a version containing commit 9edd3aa34d50f27b97be30b2ba4a6af0945ff56b or later; rebuild and reboot with the patched kernel.

How to confirm the fix worked

Confirm the running kernel contains commit 9edd3aa34d50f27b97be30b2ba4a6af0945ff56b, then attempt rmmod idxd on a single-CPU test system and verify no oops occurs.

Typical attack path

1. Obtain local root access on a single-CPU Linux system
2. Ensure the idxd driver is loaded
3. Execute rmmod idxd or equivalent module unload command
4. Trigger the cpuhp offline callback that invokes perf_event_cpu_offline

How to detect it

Search kernel logs and crash dumps for the call trace containing perf_event_cpu_offline, perf_pmu_migrate_context, and mutex_lock originating from idxd module removal; correlate with single-CPU hardware or vCPU configurations.

• perf_event_cpu_offline+0x76/0x90 [idxd]
• perf_pmu_migrate_context+0x87/0x1f0
• BUG: unable to handle page fault for address: 000000000002a2b8
• cpuhp_invoke_callback.*idxd

What your security team should do

• Apply the kernel patch containing 9edd3aa34d50f27b97be30b2ba4a6af0945ff56b immediately on all single-CPU or virtualized single-vCPU deployments
• Add kernel oops monitoring for perf_event_cpu_offline and idxd symbols to existing crash-detection pipelines
• Restrict unprivileged module unloading until systems are updated