CVE-2024-47710

What it actually does

The vulnerability allows prolonged CPU hold without yielding during sock_hash_free() when freeing maps with many buckets, resulting in soft lockups.

Why it matters to the business

Linux systems may experience temporary unresponsiveness or hangs during network map cleanup operations on large-scale deployments, impacting service availability until the kernel is updated.

How an attack unfolds

An attacker with local access creates a sock hash map containing a large number of buckets and then triggers its destruction, preventing the CPU from being yielded and inducing a soft lockup condition.

How to fix it

Update the Linux kernel to a version containing commit bcf876870b95592b52519ed4aafcf9d95999bc9c or later; apply the fix that adds cond_resched() in sock_hash_free().

How to confirm the fix worked

Verify the presence of commit bcf876870b95592b52519ed4aafcf9d95999bc9c in the kernel source or confirm the updated kernel version resolves the soft lockup reports during large map destruction.

Typical attack path

1. Obtain local access on a vulnerable Linux system
2. Create a sock hash map with a high bucket count via relevant system calls
3. Trigger destruction of the map to invoke sock_hash_free()
4. Observe or induce soft lockup due to lack of cond_resched()

How to detect it

Search kernel logs for soft lockup reports mentioning sock_hash_free() or sock_map operations; correlate with high bucket count map destruction events.

• soft lockup
• sock_hash_free
• cond_resched

What your security team should do

• Prioritize kernel updates to include the cond_resched() fix in sock_hash_free()
• Monitor for soft lockup warnings in kernel logs on systems handling large sock maps
• Test map creation and destruction workloads after patching to confirm stability