CVE-2024-42135

What it actually does

The flaw leaves vhost workers running after receiving SIGKILL instead of marking them killed, clearing virtqueue mappings, and flushing pending work, allowing lingering tasks until explicit device closure.

Why it matters to the business

Systems using virtual device backends may experience delayed process termination, resource leaks, or unexpected hangs during shutdown or signal handling, increasing operational overhead in Linux environments.

How an attack unfolds

An attacker with local access sends SIGKILL to a process managing vhost tasks; the unhandled signal allows the worker to persist, potentially leading to resource exhaustion or interference with new virtqueue operations.

How to fix it

Update the Linux kernel to include commit abe067dc3a662eef7d5cddbbc41ed50a0b68b0af or later; rebuild and deploy the patched kernel across affected systems.

How to confirm the fix worked

Confirm the commit is present in the running kernel source; test SIGKILL delivery to vhost-using processes and verify prompt worker termination and work flushing.

Typical attack path

1. Identify a process using vhost-based virtual devices
2. Deliver SIGKILL to the process
3. Observe worker lingering instead of immediate flush and exit
4. Leverage resulting resource state for denial of service or further local interference

How to detect it

Examine kernel logs for delayed vhost worker exit messages after SIGKILL; inspect process traces and virtqueue activity for lingering mappings post-termination signal.

What your security team should do

• Prioritize kernel updates on systems hosting virtual devices or high-density virtio workloads
• Monitor for pending kernel patches in stable trees and schedule maintenance windows
• Review process management scripts to ensure graceful shutdown handling around vhost tasks