CVE-2024-41032

What it actually does

The addr_to_vb_xa hash function can produce an index outside cpu_possible_mask, causing per_cpu() access to an uninitialized or non-existent CPU area and resulting in an oops/panic on architectures such as SPARC.

Why it matters to the business

Systems using affected kernel builds on SPARC or similar hardware with gaps in cpu_possible_mask may experience unexpected kernel crashes, leading to loss of availability and potential data corruption in memory-intensive workloads.

How an attack unfolds

An attacker with local access triggers vmalloc or vmap operations that exercise the per-cpu vmap_block_queue hash table; the flawed index calculation lands on a CPU not present in cpu_possible_mask, dereferencing invalid per-cpu memory and crashing the kernel.

How to fix it

Upgrade the Linux kernel to a version containing commit 28acd531c9a365dac01b32e6bc54aed8c1429bcb or later; rebuild and reboot with the corrected vmalloc code that respects cpu_possible_mask gaps.

How to confirm the fix worked

Confirm the running kernel contains commit 28acd531c9a365dac01b32e6bc54aed8c1429bcb; on SPARC hardware, exercise vmalloc workloads and verify absence of oops referencing vmap_block_queue or addr_to_vb_xa.

Typical attack path

1. Obtain local code execution on an affected SPARC system
2. Perform operations that invoke vmalloc or vmap_block allocation paths
3. Force the hash function to compute an index outside the set of possible CPUs
4. Trigger kernel oops via invalid per_cpu access

How to detect it

Search kernel logs and dmesg for oops or panic messages referencing vmalloc, vmap_block_queue, addr_to_vb_xa, or per_cpu access on SPARC; correlate with processes performing heavy vmalloc activity.

What your security team should do

• Prioritize kernel updates on all SPARC and similar non-x86 systems within the next maintenance window
• Add the fixed commit hash to internal kernel build pipelines and CI checks
• Monitor for kernel oops events on affected architectures until patches are deployed