CVE-2024-36888

What it actually does

The flaw in workqueue kick_pool() selects a target CPU using cpumask_any_and_distribute without ensuring it remains online, causing arch_vcpu_is_preempted() to dereference a null pointer for an offline CPU and trigger a kernel oops.

Why it matters to the business

Unexpected system crashes and reboots on Linux hosts can interrupt services, cause data loss in memory, and require manual recovery, with higher risk on systems that dynamically change CPU online state.

How an attack unfolds

An attacker with local code execution triggers queued work items while CPUs transition offline; the workqueue code picks an offline CPU, leading to the invalid dereference during the subsequent wake-up attempt in the scheduler.

How to fix it

Update the Linux kernel to the commit c57824d4fe07c2131f8c48687cbd5ee2be60c767 or later stable releases that incorporate the cpumask_any_and_distribute change and the cpu_online_mask masking logic.

How to confirm the fix worked

Boot the patched kernel, confirm the commit is present via git log or kernel version string, and exercise CPU hotplug plus workqueue activity while monitoring for absence of the described oops in dmesg.

Typical attack path

1. Obtain local execution context on the target system
2. Trigger frequent workqueue submissions via timers or user-space I/O
3. Force CPU offline transitions through hotplug interfaces or power management
4. Cause kick_pool() to select an offline CPU from the pool mask
5. Induce the call to arch_vcpu_is_preempted() on the invalid CPU resulting in oops

How to detect it

Search kernel logs and crash dumps for the call trace containing kick_pool, __queue_work, and arch_vcpu_is_preempted; correlate with timestamps of CPU offline events or timer softirq activity.

• kick_pool+0xa4/0x198
• arch_vcpu_is_preempted+0x12/0x80
• Unable to handle kernel pointer dereference in virtual kernel address space
• Failing address: 0000000000000000 TEID: 0000000000000803

What your security team should do

• Prioritize kernel upgrades on all systems that support CPU hotplug or variable online masks
• Apply the fixed commit c57824d4fe07c2131f8c48687cbd5ee2be60c767 through distribution updates or custom builds
• Monitor for kernel oops reports involving kick_pool and workqueue during routine operations
• Limit unprivileged access to CPU hotplug sysfs interfaces until patches are deployed