Critical Race Condition in Linux Kernel PCI Handling - linux Package Vulnerability
Summary
DEBIAN-CVE-2024-50122: In the Linux kernel, the following vulnerability has been resolved: PCI: Hold rescan lock while adding devices during host probe Since adding the PCI power control code, we may end up with a race between the pwrctl platf... Affects linux versions < 6.11.6-1. Fixed in 6.11.6-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The linux package is a core component of the Debian operating system, providing the Linux kernel that manages hardware resources and system processes. It is essential for system stability and performance, enabling communication between software and hardware. This vulnerability affects versions of the linux package in Debian 13 and 14, exposing systems to potential crashes due to improper handling of PCI device rescans.
Vulnerability Detail
In the Linux kernel, a race condition was identified between the PCI power control code and host controller probe functions. This issue arises when the rescan lock is not held while adding devices, leading to a scenario where two incompletely added devices can exist simultaneously. This can result in a kernel NULL pointer dereference, causing system crashes and instability. The specific error message indicates an inability to handle a NULL pointer dereference at a virtual address, leading to an internal error and a crash.
How To Fix
Minimum fixed version
6.11.6-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. The best course of action is to apply the patch by updating the package as mentioned above.
Conclusion
The vulnerability identified in the Linux kernel's PCI handling poses a significant risk to systems running the linux package in Debian 13 and 14. It is crucial for users to update their packages to the patched version to ensure system stability and prevent potential crashes. Monitoring tools like Vulert can assist in identifying vulnerabilities in real-time.
See every vulnerability recorded for linux →
FAQ
The vulnerability is a race condition in the Linux kernel's PCI handling, which can lead to system crashes.
The vulnerability affects the linux package in Debian 13 and 14 prior to version 6.11.6-1.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities. Visit Vulert Scanner to check if your application is affected without needing to sign up.
If exploited, this vulnerability can lead to system instability and crashes, impacting the overall performance and reliability of the system.
Currently, there are no specific workarounds available. The recommended action is to update to the patched version as soon as possible.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
