Critical Vulnerability in Linux Kernel: RCU Tasks Access Issue
Summary
DEBIAN-CVE-2024-49926: In the Linux kernel, the following vulnerability has been resolved: rcu-tasks: Fix access non-existent percpu rtpcp variable in rcu_tasks_need_gpcb() For kernels built with CONFIG_FORCE_NR_CPUS=y, the nr_cpu_ids is defin... Affects linux versions < 6.11.4-1. Fixed in 6.11.4-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of a Linux operating system, responsible for managing hardware resources and providing essential services to applications. It is highly modular and supports a wide range of hardware architectures. The kernel's stability and security are paramount, as vulnerabilities can lead to system crashes, data loss, or unauthorized access. This specific vulnerability affects the RCU (Read-Copy-Update) tasks mechanism, which is crucial for managing concurrent operations in the kernel.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the RCU tasks subsystem, specifically in the function rcu_tasks_need_gpcb(). When the kernel is built with CONFIG_FORCE_NR_CPUS enabled, the number of CPU identifiers (nr_cpu_ids) is incorrectly defined as NR_CPUS instead of the actual number of available CPUs. This discrepancy can lead to a system panic, causing the kernel to crash with a page fault error when accessing a non-existent percpu variable. The resulting crash can disrupt system operations and lead to data loss or corruption.
How To Fix
Minimum fixed version
6.11.4-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is recommended to apply the patch as soon as it is available to mitigate the risk of system crashes.
Conclusion
The identified vulnerability in the Linux kernel's RCU tasks subsystem poses a significant risk of system crashes and data loss. It is crucial for users to update their systems to the patched version 6.11.4-1 to mitigate these risks. Regular monitoring using tools like Vulert can further enhance security by providing real-time alerts for vulnerabilities.
See every vulnerability recorded for linux →
FAQ
The vulnerability can lead to system crashes and data loss due to page faults when accessing non-existent CPU variables.
You can use tools like Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected.
Yes, the patched version of the Linux kernel is 6.11.4-1. Updating to this version will resolve the vulnerability.
While there are no specific workarounds, it is advisable to monitor your system closely and apply the patch as soon as possible to avoid potential crashes.
Vulert is a tool that monitors open-source vulnerabilities in your software using a manifest file like package-lock.json. It alerts you in real-time about any vulnerabilities, helping you maintain system security.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
