CVE-2024-49976

What it actually does

The vulnerability is an ABBA deadlock in the Linux kernel tracing/timerlat subsystem: stop_kthread() holds interface_lock while the CPU hotplug path attempts cpus_read_lock, allowing concurrent osnoise_hotplug_workfn and cpuhp_thread_fun paths to deadlock on interface_lock and cpus_write_lock during CPU offline operations.

Why it matters to the business

Linux systems may experience hangs or require reboots when CPU hotplug events occur while osnoise/timerlat tracing is active, causing unplanned downtime on servers and workstations that rely on live CPU management or tracing.

How an attack unfolds

An attacker with local access triggers concurrent CPU offline operations and tracing kthread stop paths; the race between mutex_lock(interface_lock) and cpus_read_lock leads to deadlock. Named threat actors in Linux kernel campaigns could chain this for denial of service after gaining initial access.

How to fix it

Update Linux Kernel to 6.6.55 or later (commit a4a05ceffe8fad68b45de38fe2311bda619e76e2) and fwupd on Rocky Linux 8 to 1.5.9-1.el8_4; replace the mutex operations around the kthread field with xchg() and restore for_each_online_cpu() usage.

How to confirm the fix worked

Confirm running kernel version meets or exceeds the fixed release; inspect stop_kthread() and stop_per_cpu_kthreads() for the xchg() change and absence of the original mutex_lock/interface_lock pattern.

Typical attack path

1. Obtain local access on a vulnerable Linux kernel
2. Enable or trigger osnoise/timerlat tracing
3. Induce CPU hotplug/offline events via workload or privileged APIs
4. Force the ABBA lock ordering to deadlock the system

How to detect it

Review kernel logs and dmesg for repeated cpuhp or osnoise kthread warnings coinciding with CPU offline events; correlate with tracing subsystem activity around the time of hangs.

What your security team should do

• Apply kernel and fwupd updates immediately on all affected systems
• Restrict unprivileged CPU hotplug and tracing access until patched
• Monitor dmesg and kernel logs for osnoise or cpuhp deadlock signatures during rollout