Soft Lockup Vulnerability in Linux Kernel - Package: linux
Summary
DEBIAN-CVE-2024-57991: In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: chan: fix soft lockup in rtw89_entity_recalc_mgnt_roles() During rtw89_entity_recalc_mgnt_roles(), there is a normalizing process which wil... Affects linux versions < 6.12.13-1. Fixed in 6.12.13-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Linux operating system, responsible for managing hardware resources and providing essential services to software applications. It is widely used in various environments, from servers to embedded systems. The kernel's stability and performance are critical, as any vulnerabilities can lead to system crashes or degraded performance. This specific vulnerability affects the 'linux' package in Debian versions 13 and 14, highlighting a flaw in the wireless driver that can cause a soft lockup under certain conditions.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the rtw89 wireless driver, specifically in the function rtw89_entity_recalc_mgnt_roles(). The issue arises during a normalizing process where the list of entries is reordered based on a target pattern. If an entry matching the target is found, the process should terminate the loop; however, a coding error causes the outer loop to continue, potentially leading to a soft lockup. This can result in the CPU being stuck for extended periods, as indicated by kernel logs. The vulnerability can affect system performance and responsiveness, particularly in scenarios involving wireless operations.
How To Fix
Minimum fixed version
6.12.13-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the patch by updating the package as described above.
Conclusion
The soft lockup vulnerability in the Linux kernel's rtw89 wireless driver poses a risk to system performance and stability. Users are advised to update their 'linux' package to the patched version 6.12.13-1 to mitigate this issue. Regular monitoring and updates are essential for maintaining system security.
See every vulnerability recorded for linux →
FAQ
A soft lockup occurs when a CPU is unable to execute tasks for an extended period, leading to system unresponsiveness. This can happen due to infinite loops or blocking operations in the kernel.
You can use tools like Vulert to monitor and alert for open-source vulnerabilities in your software. By uploading your manifest file, you can check if your application is affected by this vulnerability.
The vulnerability can lead to system instability, degraded performance, and unresponsiveness, particularly during wireless operations.
While the primary concern is system performance, prolonged soft lockups can lead to application crashes, which may result in data loss if unsaved work is affected.
It is recommended to regularly check for updates to your packages, ideally on a weekly basis, to ensure that you are protected against known vulnerabilities.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
