CVE-2024-55916

What it actually does

Race condition allows KVP/VSS daemon to invoke channel callback before vmbus_open completes ringbuffer initialization, resulting in NULL pointer dereference in hv_pkt_iter_first during hv_kvp_onchannelcallback.

Why it matters to the business

Kernel panic on Hyper-V Linux guests can cause unplanned reboots, service disruption, and loss of availability for workloads relying on the hv_utils driver; high ecosystem prevalence of affected kernels increases exposure across cloud and virtualization environments.

How an attack unfolds

An attacker or automated process times the start of the KVP/VSS daemon before vmbus_open finishes; the daemon opens /dev/vmbus/hv_kvp, registers, and triggers hvt_op_read which calls the uninitialized channel callback, leading to panic. Listed threat actors in Linux kernel use-of-uninitialized-resource campaigns could leverage similar timing windows.

How to fix it

Upgrade to fixed kernel versions that reorder util_probe so char device creation occurs after vmbus_open; apply the reordering patch that prevents early callback registration.

How to confirm the fix worked

Confirm ringbuffer initialization precedes char device exposure by reviewing util_probe ordering in source; test by attempting daemon start during channel open and verify no NULL dereference occurs.

Typical attack path

1. Unload and reload hv_utils driver
2. Delay ringbuffer init with sleep in __vmbus_open
3. Start kvp/vss daemon within the window
4. Daemon writes KVP_OP_REGISTER1 and reads response
5. Callback executes before ringbuffer init causing NULL dereference

How to detect it

Search kernel logs for hv_kvp_daemon or hv_vss_daemon entries followed immediately by BUG: kernel NULL pointer dereference and hv_pkt_iter_first traces; inspect dmesg and syslog around hv_utils registration events.

• hv_kvp_daemon.*BUG: kernel NULL pointer dereference
• hv_pkt_iter_first+0x12
• kvp_register_done called before vmbus_open

What your security team should do

• Prioritize kernel updates on all Hyper-V Linux guests within 48 hours given published date and threat actor mentions
• Monitor for hv_utils reloads or manual daemon starts in production
• Disable unnecessary KVP/VSS services if not required