Critical Reference Count Vulnerability in Linux Kernel - DEBIAN-CVE-2024-53075
Summary
DEBIAN-CVE-2024-53075: In the Linux kernel, the following vulnerability has been resolved: riscv: Prevent a bad reference count on CPU nodes When populating cache leaves we previously fetched the CPU device node at the very beginning. Affects linux versions < 6.11.7-1. Fixed in 6.11.7-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Linux operating system, managing hardware and system resources. It provides essential services for all other parts of the operating system and is crucial for system stability and performance. This vulnerability affects the Linux kernel versions in Debian 13 and 14, specifically related to the handling of CPU device nodes when ACPI is enabled.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified where a bad reference count on CPU nodes could occur. This issue arises during the population of cache leaves, where the CPU device node is fetched prematurely. When ACPI is enabled, the code may return early without properly releasing the node, leading to a reference count error. This can potentially cause system instability or crashes due to improper memory management. Additionally, the previous implementation lacked error checking when acquiring the device node, which has now been addressed.
How To Fix
Minimum fixed version
6.11.7-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the available patch as soon as possible.
Conclusion
The DEBIAN-CVE-2024-53075 vulnerability in the Linux kernel poses a significant risk to system stability due to improper handling of CPU device nodes. It is crucial to update to the patched version 6.11.7-1 to mitigate this risk. Users are encouraged to utilize tools like Vulert for ongoing monitoring of vulnerabilities in their software.
See every vulnerability recorded for linux →
FAQ
DEBIAN-CVE-2024-53075 is a vulnerability in the Linux kernel that affects CPU device node reference counting, potentially leading to system instability.
You can use Vulert, which monitors open-source vulnerabilities in your software. By uploading your manifest file like package-lock.json, you can check for vulnerabilities without needing to install any software.
Failure to address this vulnerability may result in system crashes or instability due to improper memory management related to CPU device nodes.
Yes, you should update to version 6.11.7-1 or later to ensure that the vulnerability is patched.
Detailed information can be found in the official Debian CVE database or by visiting the Vulert website for real-time monitoring of vulnerabilities.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
