CVE-2024-47143

What it actually does

Race condition causing deadlock when dma debug API holds rq_lock while check_unmap() and add_dma_entry() contend for radix_lock and dma_entry_hash locks in inconsistent order during radix tree extension or perf event scheduling.

Why it matters to the business

Kernel deadlocks can render systems unresponsive in DMA debugging environments, especially those using Arm Coresight hardware tracing, increasing downtime risk for Linux workloads though exploitation remains unlikely.

How an attack unfolds

Concurrent DMA free/sync operations and scheduler events (such as perf_event_task_sched_out) trigger lock inversion between rq_lock, radix_lock, and dma hash buckets, leading to deadlock; listed threat actor campaigns targeting other kernel issues do not appear to weaponize this specific race.

How to fix it

Upgrade Linux kernel to commit 3ccce34a5c3f5c9541108a451657ade621524b32 or later; for Ubuntu 18.04/20.04 LTS apply libxtst 2:1.2.3-1 packages where applicable and rebuild custom kernels with the dma-debug lock ordering fix.

How to confirm the fix worked

Confirm kernel version contains commit 3ccce34a5c3f5c9541108a451657ade621524b32; reproduce deadlock scenario with DMA debug enabled and Arm Coresight drivers under concurrent perf and DMA operations to verify absence of hang.

Typical attack path

1. Invoke dma_free_attrs() on CPU0 while holding rq_lock indirectly via scheduler
2. Trigger add_dma_entry() on CPU1 extending radix tree and acquiring radix_lock
3. Schedule perf sync on CPU2 attempting dma_entry_hash while holding rq_lock
4. Induce wake_all_kswapd or similar to complete the circular wait on locks

How to detect it

Review kernel logs for deadlock traces involving radix_lock, dma_entry_hash, and rq_lock; correlate with perf_event deletion and Arm Coresight driver activity; no widespread threat actor exploitation noted for this issue.

What your security team should do

• Apply the referenced kernel commit or distribution update immediately on systems with DMA debugging enabled
• Disable DMA debug if not required in production to reduce exposure surface
• Monitor for kernel lockup or hung task messages in dmesg after patching