CVE-2024-43889

What it actually does

Divide-by-zero panic in padata_mt_helper() when padata_mt_job.min_chunk is zero, causing chunk_size to be zero during multithreaded work dispatch in the Linux kernel padata subsystem.

Why it matters to the business

Unexpected kernel panic during boot or under specific parallel workloads leads to system crashes, downtime, and potential loss of in-memory work on affected Linux systems.

How an attack unfolds

An attacker with local access supplies a padata_mt_job structure with min_chunk set to zero to padata_do_multithreaded(), triggering the zero chunk_size calculation inside the worker thread and causing an immediate divide error panic.

How to fix it

Update the Linux kernel to a version containing commit ab8b397d5997d8c37610252528edc54bebf9f6d3 or later; ensure min_chunk is clamped to at least 1 in any callers of padata_mt_job.

How to confirm the fix worked

Confirm the patch is present by checking for the commit in the running kernel source or by verifying that padata_mt_helper() now forces chunk_size >= 1; test with a crafted padata_mt_job that previously triggered the panic.

Typical attack path

1. Obtain local code execution or user-level access on a vulnerable Linux system
2. Invoke padata_do_multithreaded() with a padata_mt_job where min_chunk equals zero
3. Trigger the events_unbound workqueue to run padata_mt_helper()
4. Cause divide-by-zero exception and kernel oops

How to detect it

Search kernel logs and dmesg for 'divide error' combined with 'padata_mt_helper' and stack traces showing padata_do_multithreaded; inspect workqueue activity around the time of the panic for events_unbound.

• divide error: 0000 1 PREEMPT SMP NOPTI
• padata_mt_helper+0x39/0xb0
• Workqueue: events_unbound padata_mt_helper
• RIP: 0010:padata_mt_helper

What your security team should do

• Apply the kernel update containing ab8b397d5997d8c37610252528edc54bebf9f6d3 as soon as possible on all affected systems
• Monitor boot and workqueue logs for divide error oops referencing padata_mt_helper
• Review any custom kernel modules or drivers that call padata_do_multithreaded and enforce non-zero min_chunk