CVE-2024-43890

What it actually does

Overflow of tracing_map->next_elt in get_free_elt() permits insertions past max_elts, allowing the map to reach max_size with no free entries; subsequent __tracing_map_insert() calls then spin in an infinite loop with preemption disabled, hanging the CPU.

Why it matters to the business

Local users or processes can trigger denial-of-service conditions that freeze affected Linux systems, interrupting workloads and requiring manual intervention or reboot.

How an attack unfolds

An attacker with local access exercises tracing map insertion paths repeatedly until next_elt overflows, fills the map, and forces an infinite loop inside __tracing_map_insert with preemption disabled, resulting in a CPU hang.

How to fix it

Upgrade the Linux kernel to a version containing commit 302ceb625d7b990db205a15e371f9a71238de91c or apply the equivalent stable backport that caps next_elt at max_elt.

How to confirm the fix worked

Confirm the running kernel contains the referenced commit or a later equivalent; exercise tracing map workloads under load and verify no CPU hang occurs when the map reaches capacity.

Typical attack path

1. Obtain local execution on the target Linux system
2. Trigger repeated tracing_map insertions to drive next_elt past max_elt
3. Force the map to become full and invoke __tracing_map_insert to induce the infinite loop

How to detect it

Review kernel logs for repeated tracing map insertion attempts followed by CPU hang or soft-lockup messages; correlate with processes using the tracing subsystem.

What your security team should do

• Prioritize kernel updates containing the fix across all Linux distributions and Android devices
• Restrict untrusted local access until patches are deployed
• Monitor vendor advisories for backported releases