CVE-2024-42240

What it actually does

The flaw causes entry_SYSENTER_compat() to invoke CLEAR_BRANCH_HISTORY and clear_bhb_loop() while the TF flag remains set, so the subsequent #DB exception triggers a warning inside exc_debug_kernel() because single-step execution occurs outside the expected entry point.

Why it matters to the business

Produces spurious kernel warnings and may crash user-space programs on systems running affected kernels with BHI mitigation, creating log noise and minor operational friction until patched; low urgency given CVSS 5.5 and no KEV listing.

How an attack unfolds

A local attacker compiles a small program that pushes the trap flag, executes sysenter, and triggers the race between BHI clearing and TF clearing; the kernel then emits a WARNING in exc_debug_kernel while handling the debug exception.

How to fix it

Update the Linux kernel to 5.15.163 or later, or apply commit db56615e96c439e13783d7715330e824b4fd4b84. For AlmaLinux 8 systems also upgrade boom-boot, boom-boot-conf, boom-boot-grub2 and python3-boom to 1.3-2.el8.

How to confirm the fix worked

Confirm kernel version >= 5.15.163, rebuild and re-run the sysenter_step test case, and verify that no WARNING referencing exc_debug_kernel and clear_bhb_loop appears in dmesg.

Typical attack path

1. Obtain local unprivileged access to an affected x86 Linux system with BHI mitigation enabled
2. Compile the sysenter_step reproducer that sets TF before sysenter
3. Execute the binary to force the misordered CLEAR_BRANCH_HISTORY call
4. Observe the resulting kernel WARNING and program segmentation fault

How to detect it

Search kernel logs and dmesg for the exact warning string "WARNING: CPU.*exc_debug_kernel" accompanied by a stack trace showing clear_bhb_loop called from entry_SYSENTER_compat_after_hwframe.

What your security team should do

• Apply the kernel update to 5.15.163 (or the backported commit) on all affected hosts within standard patch windows
• Add the exc_debug_kernel warning signature to log-monitoring rules until patches are deployed
• Re-test BHI mitigation paths after the update to ensure the TF-handling order is corrected