CVE-2024-42126

What it actually does

The flaw occurs when nmi_enter()/nmi_exit() are invoked from real-mode interrupt handlers (early HMI/MCE) on powerpc with CONFIG_NEED_PER_CPU_PAGE_FIRST_CHUNK; percpu variables may reside in vmalloc space, causing invalid memory access and kernel crash in rcu_nmi_enter.

Why it matters to the business

PowerPC Linux systems using certain percpu allocation settings or kernel command-line options can experience unexpected kernel panics during early machine-check or hypervisor maintenance interrupts, leading to unplanned downtime and potential data loss in critical workloads.

How an attack unfolds

An attacker or environmental condition triggers an early real-mode interrupt (HMI or MCE) on a vulnerable powerpc kernel where percpu memory resides in vmalloc; the NMI entry code then dereferences an invalid address, crashing the kernel before any higher-level mitigation can occur. No widespread in-the-wild exploitation is recorded for this specific issue.

How to fix it

Update the Linux kernel to commit fb6675db04c4b79883373edc578d5df7bbc84848 or later stable releases that avoid nmi_enter/nmi_exit in real-mode paths; rebuild and reboot affected powerpc systems.

How to confirm the fix worked

Confirm the running kernel contains commit fb6675db04c4b79883373edc578d5df7bbc84848 via git log or uname -r against a patched distribution build; test with percpu_alloc=page and synthetic early interrupts to verify no crash occurs.

Typical attack path

1. Boot or run Linux kernel on powerpc with CONFIG_NEED_PER_CPU_PAGE_FIRST_CHUNK and percpu_alloc=page
2. Trigger early real-mode HMI or machine-check exception
3. DEFINE_INTERRUPT_HANDLER_NMI wrapper calls nmi_enter()
4. rcu_nmi_enter accesses percpu data in vmalloc area from real mode
5. Kernel dereferences invalid address and panics

How to detect it

Review kernel crash logs for machine_check_early and rcu_nmi_enter stack traces; correlate with boot messages showing percpu allocation from vmalloc and early HMI/MCE events.

What your security team should do

• Prioritize patching powerpc production kernels within standard change windows
• Audit kernel boot parameters for percpu_alloc=page usage
• Monitor for similar real-mode NMI handling issues in future powerpc kernel updates