CVE-2024-56690

What it actually does

The pcrypt module returns -EAGAIN on CPU online/offline events after the referenced padata change, causing alg_test to emit a WARN that panics the kernel when panic_on_warn=1; the fix bypasses parallelization and calls the crypto layer directly on -EBUSY.

Why it matters to the business

Kernels in production may panic during routine CPU hotplug events, interrupting services and requiring reboots; the low EPSS and absence from KEV indicate limited active exploitation risk but the bug affects any system using pcrypt with test paths or panic_on_warn enabled.

How an attack unfolds

An attacker triggers repeated CPU online/offline events while pcrypt encryption or decryption operations are active, forcing the -EAGAIN path that surfaces as a WARN and potential panic; listed Linux kernel threat actors and campaigns may probe similar race conditions but this specific issue shows no observed in-the-wild exploitation.

How to fix it

Upgrade the Linux kernel to the fixed commit d8a5b80568a9cb66810e75b182018e9edb68e8ff (or later equivalent release) in the torvalds/linux.git tree; disable panic_on_warn temporarily as a short-term mitigation if immediate patching is not possible.

How to confirm the fix worked

Confirm the running kernel contains commit d8a5b80568a9cb66810e75b182018e9edb68e8ff, re-run alg_test under CPU hotplug load, and verify absence of -EAGAIN WARN messages.

Typical attack path

1. Identify systems using pcrypt for parallel crypto operations
2. Induce CPU hotplug events via workload or administrative action
3. Observe pcrypt_aead_encrypt/decrypt returning -EAGAIN
4. Trigger WARN in alg_test and cause kernel panic if panic_on_warn is set

How to detect it

Search kernel logs for pcrypt-related -EAGAIN returns, alg_test WARN entries, and any panic_on_warn triggered crashes around CPU hotplug timestamps.

What your security team should do

• Prioritize kernel upgrade to the listed fixed commit within standard change windows
• Audit workloads that rely on pcrypt or set panic_on_warn
• Monitor EPSS trend and KEV status for any future changes