CVE-2024-36916

What it actually does

Undefined behavior from right-shifting a 64-bit delay value by an out-of-bounds exponent (64) in blk-iocost iocg_kick_delay, caught by UBSAN on some architectures.

Why it matters to the business

Linux systems using the block I/O cost controller may experience unpredictable kernel behavior or crashes; high ecosystem prevalence in servers and devices increases operational risk until patched.

How an attack unfolds

A local attacker triggers ioc_timer_fn and iocg_kick_delay paths that compute an excessive shift amount for iocg->delay, invoking undefined behavior; no remote or unauthenticated exploitation is known.

How to fix it

Upgrade the Linux kernel to a version containing commit 62accf6c1d7b433752cb3591bba8967b7a801ad5 or later; rebuild and reboot with the fixed kernel.

How to confirm the fix worked

Confirm the running kernel includes commit 62accf6c1d7b433752cb3591bba8967b7a801ad5; recompile with UBSAN enabled and verify absence of shift-out-of-bounds reports in blk-iocost.c:1366.

Typical attack path

1. Obtain local user or process access on an affected Linux system
2. Configure or exercise blk-iocost I/O cost accounting under conditions producing a shift exponent >= 64
3. Invoke iocg_kick_delay via timer or I/O path to trigger the out-of-bounds shift

How to detect it

Review kernel logs for UBSAN shift-out-of-bounds messages referencing block/blk-iocost.c and iocg_kick_delay; no persistent artifacts or network indicators exist.

What your security team should do

• Prioritize kernel updates on all systems exposing blk-iocost
• Monitor for UBSAN reports in production kernels
• Test I/O-heavy workloads after patching to confirm stability