CVE-2024-44958

What it actually does

Unbalanced decrement of sched_smt_present before a failing sched_cpu_deactivate call in the CPU hotplug path triggers a negative static key count warning in jump_label during error handling of cpuset_cpu_inactive failures.

Why it matters to the business

Unexpected kernel warnings and potential instability during CPU offline operations under stress or power-management conditions increase operational risk and may require unplanned reboots or kernel updates on affected Linux systems.

How an attack unfolds

An attacker with local access triggers repeated CPU hotplug or power-state transitions while forcing cpuset_cpu_inactive failures, causing the unbalanced sched_smt_present counter to reach a negative state and surface the jump-label warning.

How to fix it

Update the Linux kernel to the fixed commit 8fe28cb58bcb235034b64cbbb7550a8a43fd88be or later; apply vendor-supplied kernel packages containing the sched/smt balance fix.

How to confirm the fix worked

Confirm kernel version contains commit 8fe28cb58bcb235034b64cbbb7550a8a43fd88be; reproduce CPU hotplug stress tests and verify absence of the jump-label negative-count warning.

Typical attack path

1. Obtain local execution on a Linux system with SMT enabled
2. Induce CPU offline or deactivate events under load or error conditions
3. Force cpuset_cpu_inactive to fail inside sched_cpu_deactivate
4. Observe negative static-key count warning and potential follow-on scheduler anomalies

How to detect it

Search kernel logs for the exact string 'jump label: negative count!' combined with call traces containing sched_cpu_deactivate and static_key_slow_try_dec; correlate with CPU hotplug or cpuset activity.

What your security team should do

• Prioritize kernel upgrades on all production Linux systems within the next maintenance window
• Monitor for the jump-label warning in kernel logs during CPU hotplug events
• Test the fixed kernel in staging environments that exercise CPU offline paths