CVE-2024-40966

What it actually does

The vulnerability permits attachment of non-N_TTY line disciplines such as N_GSM to virtual terminals, violating the non-sleeping write rule and triggering sleeping functions under spinlocks in console handling paths.

Why it matters to the business

Kernel instability or crashes on systems using virtual consoles can lead to service outages, data loss, and unplanned reboots, especially on long-lived Linux deployments where kernel updates are delayed.

How an attack unfolds

An attacker with local access attaches the N_GSM line discipline to a virtual terminal, then performs write operations that invoke con_write() while a spinlock is held, causing the invalid-context sleep bug reported in printk.

How to fix it

Upgrade the Linux kernel to the commit 3c6332f3bb1578b5b10ac2561247b1d6272ae937 or later stable releases that enforce the N_TTY-only restriction for virtual terminals.

How to confirm the fix worked

Verify the running kernel contains commit 3c6332f3bb1578b5b10ac2561247b1d6272ae937; confirm virtual terminals reject non-N_TTY line disciplines via TIOCSETD; test that attaching N_GSM fails with an appropriate error.

Typical attack path

1. Obtain local shell or process execution on target Linux system
2. Open a virtual terminal device
3. Use TIOCSETD ioctl to attach N_GSM line discipline
4. Trigger write path that calls con_write under spinlock
5. Induce kernel BUG and potential denial of service or escalation

How to detect it

Search kernel logs for BUG entries referencing sleeping functions in printk.c combined with con_write or gsmld_write; inspect audit logs for TIOCSETD ioctls targeting virtual terminal devices.

What your security team should do

• Prioritize kernel upgrade to the fixed commit on all production systems within the next maintenance window
• Audit systems for any custom line-discipline usage on virtual consoles and remove non-N_TTY attachments
• Monitor kernel logs for sleeping-function-from-invalid-context BUGs involving printk and con_write
• Apply defense-in-depth by restricting unprivileged ioctl access where possible