CVE-2024-44968

What it actually does

Retrieves a per-CPU pointer in preemptible context before use in hotplug_cpu__broadcast_tick_pull, allowing compilers to keep the smp_processor_id() call outside the non-preemptible region and trigger BUG warnings or incorrect broadcast timer behavior during CPU hotplug.

Why it matters to the business

May cause kernel instability, warnings, or crashes during CPU hotplug or power management events on affected Linux systems, increasing operational risk for servers and devices until patched; prevalence in the Linux kernel ecosystem amplifies exposure across distributions and embedded devices.

How an attack unfolds

An attacker with local access triggers CPU hotplug events while the vulnerable per-CPU access occurs in preemptible context, potentially leading to incorrect processor ID usage in broadcast timer takeover; listed threat actors in 2024 campaigns have targeted similar Linux kernel resource issues but this specific flaw shows no confirmed active exploitation.

How to fix it

Upgrade Linux kernel to version 6.1.105 or later (or equivalent stable branch commit f54abf332a2bc0413cfa8bd6a8511f7aa99faea0); apply vendor backports for other supported series; for github.com/artdarek/go-unzip update to 2.0.0 if that package is in use.

How to confirm the fix worked

Confirm kernel version is at or above the fixed release; run smp_processor_id() context checks or hotplug stress tests to verify absence of the preemptible access warning; review dmesg for resolved BUG messages after upgrade.

Typical attack path

1. Identify unpatched Linux kernel version running on target
2. Obtain local execution or trigger CPU hotplug via power management or virtualization interfaces
3. Force broadcast timer takeover path during preemptible window
4. Observe or induce BUG or system instability from incorrect smp_processor_id usage

How to detect it

Search kernel logs for smp_processor_id() preemptible BUG messages referencing hotplug_cpu__broadcast_tick_pull; inspect dmesg or syslog around CPU offline/online events; no widespread exploitation artifacts reported.

What your security team should do

• Prioritize kernel upgrades on all systems within 30 days given ecosystem prevalence
• Monitor for CPU hotplug-related kernel warnings in production workloads
• Apply vendor security updates immediately on internet-facing or multi-tenant hosts
• Test hotplug and suspend/resume paths in staging environments before rollout