CVE-2024-57849

What it actually does

Use-after-free in s390/cpum_sf sampling buffers: CPU hotplug remove deallocates SDBs and clears PMU_F_RESERVED, but perf_event_exit_cpu later calls cpumsf_pmu_stop/hw_perf_event_update which reads the freed buffers.

Why it matters to the business

Kernel instability, crashes or memory corruption on s390 systems during CPU hotplug with active perf sampling; limited scope but affects production Linux environments that perform CPU offline or live migration.

How an attack unfolds

Attacker with local access triggers CPU hot-unplug while a perf sampling event is active on s390; the subsequent perf_event_exit path dereferences already-freed SDB memory, producing invalid samples or a crash. No public exploits or named threat actors are tied to this specific flaw.

How to fix it

Update the Linux kernel to a version containing the fix that checks PMU_F_RESERVED before accessing SDBs in cpumsf_pmu_stop. Reboot after installing the updated kernel package.

How to confirm the fix worked

Confirm the PMU_F_RESERVED guard exists in s390_pmu_sf_offline_cpu and setup_pmc_cpu; run perf sampling tests that include CPU offline/online cycles and verify no oops or slab-use-after-free reports occur.

Typical attack path

1. Obtain local execution on s390 Linux
2. Start a perf sampling event that allocates SDBs
3. Trigger CPUHP_AP_PERF_S390_SF_OFFLINE (hot-unplug)
4. Allow perf_event_exit_cpu to invoke cpumsf_pmu_del on the removed CPU
5. Observe use-after-free when hw_perf_event_update accesses released buffers

How to detect it

Inspect kernel logs for oops/panic strings containing cpum_sf, s390_pmu_sf_offline_cpu, deallocate_buffers or use-after-free in perf_event context; correlate with perf sampling start times and CPU hotplug events.

What your security team should do

• Apply the patched kernel immediately on all s390 systems that use perf sampling
• Disable or restrict perf_event_open for untrusted users until patched
• Monitor CPU hotplug events in production via dmesg and kernel logs
• Test live-migration or CPU offline procedures after patching