CVE-2024-49935

ACPI: PAD: fix crash in exit_round_robin()

MEDIUM

5.5

CVSS Score

Published: October 21, 2024 at 06:01 PM UTC

Updated: June 17, 2026 at 08:00 AM UTC

1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

MEDIUM5.5

Exploit prediction

EPSS 0.2%

SSVC

No known exploit

Description

In the Linux kernel, the following vulnerability has been resolved: ACPI: PAD: fix crash in exit_round_robin() The kernel occasionally crashes in cpumask_clear_cpu(), which is called within exit_round_robin(), because when executing clear_bit(nr, addr) with nr set to 0xffffffff, the address calculation may cause misalignment within the memory, leading to access to an invalid memory address. ---------- BUG: unable to handle kernel paging request at ffffffffe0740618 ... CPU: 3 PID: 2919323 Comm: acpi_pad/14 Kdump: loaded Tainted: G OE X --------- - - 4.18.0-425.19.2.el8_7.x86_64 #1 ... RIP: 0010:power_saving_thread+0x313/0x411 [acpi_pad] Code: 89 cd 48 89 d3 eb d1 48 c7 c7 55 70 72 c0 e8 64 86 b0 e4 c6 05 0d a1 02 00 01 e9 bc fd ff ff 45 89 e4 42 8b 04 a5 20 82 72 c0 <f0> 48 0f b3 05 f4 9c 01 00 42 c7 04 a5 20 82 72 c0 ff ff ff ff 31 RSP: 0018:ff72a5d51fa77ec8 EFLAGS: 00010202 RAX: 00000000ffffffff RBX: ff462981e5d8cb80 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000246 RDI: 0000000000000246 RBP: ff46297556959d80 R08: 0000000000000382 R09: ff46297c8d0f38d8 R10: 0000000000000000 R11: 0000000000000001 R12: 000000000000000e R13: 0000000000000000 R14: ffffffffffffffff R15: 000000000000000e FS: 0000000000000000(0000) GS:ff46297a800c0000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffffffe0740618 CR3: 0000007e20410004 CR4: 0000000000771ee0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: ? acpi_pad_add+0x120/0x120 [acpi_pad] kthread+0x10b/0x130 ? set_kthread_struct+0x50/0x50 ret_from_fork+0x1f/0x40 ... CR2: ffffffffe0740618 crash> dis -lr ffffffffc0726923 ... /usr/src/debug/kernel-4.18.0-425.19.2.el8_7/linux-4.18.0-425.19.2.el8_7.x86_64/./include/linux/cpumask.h: 114 0xffffffffc0726918 <power_saving_thread+776>: mov %r12d,%r12d /usr/src/debug/kernel-4.18.0-425.19.2.el8_7/linux-4.18.0-425.19.2.el8_7.x86_64/./include/linux/cpumask.h: 325 0xffffffffc072691b <power_saving_thread+779>: mov -0x3f8d7de0(,%r12,4),%eax /usr/src/debug/kernel-4.18.0-425.19.2.el8_7/linux-4.18.0-425.19.2.el8_7.x86_64/./arch/x86/include/asm/bitops.h: 80 0xffffffffc0726923 <power_saving_thread+787>: lock btr %rax,0x19cf4(%rip) # 0xffffffffc0740620 <pad_busy_cpus_bits> crash> px tsk_in_cpu[14] $66 = 0xffffffff crash> px 0xffffffffc072692c+0x19cf4 $99 = 0xffffffffc0740620 crash> sym 0xffffffffc0740620 ffffffffc0740620 (b) pad_busy_cpus_bits [acpi_pad] crash> px pad_busy_cpus_bits[0] $42 = 0xfffc0 ---------- To fix this, ensure that tsk_in_cpu[tsk_index] != -1 before calling cpumask_clear_cpu() in exit_round_robin(), just as it is done in round_robin_cpu(). [ rjw: Subject edit, avoid updates to the same value ]

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Linux Kernel · Linux

95%

v < 5.15.1682.6.32 ≤ v < 5.10.2402.6.32 ≤ v < 5.15.1682.6.32 ≤ v < 5.4.2962.6.32 ≤ v < 6.1.1132.6.32 ≤ v < 6.10.142.6.32 ≤ v < 6.11.32.6.32 ≤ v < 6.122.6.32 ≤ v < 6.6.555.16 ≤ v < 6.1.1136.11 ≤ v < 6.11.36.2 ≤ v < 6.6.556.7 ≤ v < 6.10.142.6.328e0af5141ab950b78b3ebbfaded5439dcf8b3a8d

Vendor states this is fixed in 03593dbb0b272ef7b0358b099841e65735422aca (fixed)

Vendor states this is fixed in 0a2ed70a549e61c5181bad5db418d223b68ae932 (fixed)

Vendor states this is fixed in 27c045f868f0e5052c6b532868a65e0cd250c8fc (fixed)

Vendor states this is fixed in 68a599da16ebad442ce295d8d2d5c488e3992822 (fixed)

Vendor states this is fixed in 68a8e45743d6a120f863fb14b72dc59616597019 (fixed)

Vendor states this is fixed in 82191a21a0dedc8c64e14f07f5d568d09bc4b331 (fixed)

Vendor states this is fixed in 92e5661b7d0727ab912b76625a88b33fdb9b609a (fixed)

Vendor states this is fixed in d214ffa6eb39c08d18a460124dd7ba318dc56f33 (fixed)

Vendor states this is fixed in 2.6.32 (unaffected)

Vendor states this is fixed in 5.10.240 (unaffected)

Vendor states this is fixed in 5.15.168 (unaffected)

Vendor states this is fixed in 5.4.296 (unaffected)