CVE-2024-44958

sched/smt: Fix unbalance sched_smt_present dec/inc

MEDIUM

5.5

CVSS Score

Published: September 4, 2024 at 06:35 PM UTC

Updated: June 17, 2026 at 07:53 AM UTC

1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

MEDIUM5.5

Exploit prediction

EPSS 0.2%

SSVC

No known exploit

Description

In the Linux kernel, the following vulnerability has been resolved: sched/smt: Fix unbalance sched_smt_present dec/inc I got the following warn report while doing stress test: jump label: negative count! WARNING: CPU: 3 PID: 38 at kernel/jump_label.c:263 static_key_slow_try_dec+0x9d/0xb0 Call Trace: <TASK> __static_key_slow_dec_cpuslocked+0x16/0x70 sched_cpu_deactivate+0x26e/0x2a0 cpuhp_invoke_callback+0x3ad/0x10d0 cpuhp_thread_fun+0x3f5/0x680 smpboot_thread_fn+0x56d/0x8d0 kthread+0x309/0x400 ret_from_fork+0x41/0x70 ret_from_fork_asm+0x1b/0x30 </TASK> Because when cpuset_cpu_inactive() fails in sched_cpu_deactivate(), the cpu offline failed, but sched_smt_present is decremented before calling sched_cpu_deactivate(), it leads to unbalanced dec/inc, so fix it by incrementing sched_smt_present in the error path.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Linux Kernel · Linux

95%

v ≥ 4.14.86v ≥ 4.19.74.14.86 ≤ v < 4.154.19.7 ≤ v < 4.204.20 ≤ v < 5.15.1654.20 ≤ v < 6.1.1054.20 ≤ v < 6.10.54.20 ≤ v < 6.114.20 ≤ v < 6.6.465.16 ≤ v < 6.1.1056.2 ≤ v < 6.6.466.7 ≤ v < 6.10.51659361c63fdc91c0af239d8cdd211d590a6564.14.86 4.19.7 6.11 rc1a2c094816f894b7a265851fad858e994fa0f78b3c5511d03ec090980732e929c318a7a6374b5550e

Vendor states this is fixed in 2a3548c7ef2e135aee40e7e5e44e7d11b893e7c4 (fixed)

Vendor states this is fixed in 2cf7665efe451e48d27953e6b5bc627d518c902b (fixed)

Vendor states this is fixed in 65727331b60197b742089855ac09464c22b96f66 (fixed)

Vendor states this is fixed in d0c87a3c6be10a57aa3463c32c3fc6b2a47c3dab (fixed)

Vendor states this is fixed in e22f910a26cc2a3ac9c66b8e935ef2a7dd881117 (fixed)

Affected range stops below 4.15, so it looks safe — our inference, not a vendor statement

Vendor states this is fixed in 4.20 (unaffected)

Vendor states this is fixed in 5.15.165 (unaffected)

Vendor states this is fixed in 6.1.105 (unaffected)

Vendor states this is fixed in 6.10.5 (unaffected)

Vendor states this is fixed in 6.11 (unaffected)

Vendor states this is fixed in 6.6.46 (unaffected)