CVE-2024-49866 (GCVE-0-2024-49866)

Vulnerability from cvelistv5 – Published: 2024-10-21 18:01 – Updated: 2026-08-05 11:40
VLAI
Title
tracing/timerlat: Fix a race during cpuhp processing
Summary
In the Linux kernel, the following vulnerability has been resolved: tracing/timerlat: Fix a race during cpuhp processing There is another found exception that the "timerlat/1" thread was scheduled on CPU0, and lead to timer corruption finally: ``` ODEBUG: init active (active state 0) object: ffff888237c2e108 object type: hrtimer hint: timerlat_irq+0x0/0x220 WARNING: CPU: 0 PID: 426 at lib/debugobjects.c:518 debug_print_object+0x7d/0xb0 Modules linked in: CPU: 0 UID: 0 PID: 426 Comm: timerlat/1 Not tainted 6.11.0-rc7+ #45 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014 RIP: 0010:debug_print_object+0x7d/0xb0 ... Call Trace: <TASK> ? __warn+0x7c/0x110 ? debug_print_object+0x7d/0xb0 ? report_bug+0xf1/0x1d0 ? prb_read_valid+0x17/0x20 ? handle_bug+0x3f/0x70 ? exc_invalid_op+0x13/0x60 ? asm_exc_invalid_op+0x16/0x20 ? debug_print_object+0x7d/0xb0 ? debug_print_object+0x7d/0xb0 ? __pfx_timerlat_irq+0x10/0x10 __debug_object_init+0x110/0x150 hrtimer_init+0x1d/0x60 timerlat_main+0xab/0x2d0 ? __pfx_timerlat_main+0x10/0x10 kthread+0xb7/0xe0 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x2d/0x40 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30 </TASK> ``` After tracing the scheduling event, it was discovered that the migration of the "timerlat/1" thread was performed during thread creation. Further analysis confirmed that it is because the CPU online processing for osnoise is implemented through workers, which is asynchronous with the offline processing. When the worker was scheduled to create a thread, the CPU may has already been removed from the cpu_online_mask during the offline process, resulting in the inability to select the right CPU: T1 | T2 [CPUHP_ONLINE] | cpu_device_down() osnoise_hotplug_workfn() | | cpus_write_lock() | takedown_cpu(1) | cpus_write_unlock() [CPUHP_OFFLINE] | cpus_read_lock() | start_kthread(1) | cpus_read_unlock() | To fix this, skip online processing if the CPU is already offline.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator (v2.0.3)
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: c8895e271f7994a3ecb13b8a280e39aa53879545 , < 322920b53dc11f9c2b33397eb3ae5bc6a175b60d (git)
Affected: c8895e271f7994a3ecb13b8a280e39aa53879545 , < ce25f33ba89d6eefef64157655d318444580fa14 (git)
Affected: c8895e271f7994a3ecb13b8a280e39aa53879545 , < a6e9849063a6c8f4cb2f652a437e44e3ed24356c (git)
Affected: c8895e271f7994a3ecb13b8a280e39aa53879545 , < a0d9c0cd5856191e095cf43a2e141b73945b7716 (git)
Affected: c8895e271f7994a3ecb13b8a280e39aa53879545 , < f72b451dc75578f644a3019c1489e9ae2c14e6c4 (git)
Affected: c8895e271f7994a3ecb13b8a280e39aa53879545 , < 829e0c9f0855f26b3ae830d17b24aec103f7e915 (git)
Create a notification for this product.
Linux Linux Affected: 5.14
Unaffected: 0 , < 5.14 (semver)
Unaffected: 5.15.168 , ≤ 5.15.* (semver)
Unaffected: 6.1.113 , ≤ 6.1.* (semver)
Unaffected: 6.6.55 , ≤ 6.6.* (semver)
Unaffected: 6.10.14 , ≤ 6.10.* (semver)
Unaffected: 6.11.3 , ≤ 6.11.* (semver)
Unaffected: 6.12 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-49866",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-22T13:47:35.638203Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-22T13:48:52.640Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T22:22:33.052Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/trace/trace_osnoise.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "322920b53dc11f9c2b33397eb3ae5bc6a175b60d",
              "status": "affected",
              "version": "c8895e271f7994a3ecb13b8a280e39aa53879545",
              "versionType": "git"
            },
            {
              "lessThan": "ce25f33ba89d6eefef64157655d318444580fa14",
              "status": "affected",
              "version": "c8895e271f7994a3ecb13b8a280e39aa53879545",
              "versionType": "git"
            },
            {
              "lessThan": "a6e9849063a6c8f4cb2f652a437e44e3ed24356c",
              "status": "affected",
              "version": "c8895e271f7994a3ecb13b8a280e39aa53879545",
              "versionType": "git"
            },
            {
              "lessThan": "a0d9c0cd5856191e095cf43a2e141b73945b7716",
              "status": "affected",
              "version": "c8895e271f7994a3ecb13b8a280e39aa53879545",
              "versionType": "git"
            },
            {
              "lessThan": "f72b451dc75578f644a3019c1489e9ae2c14e6c4",
              "status": "affected",
              "version": "c8895e271f7994a3ecb13b8a280e39aa53879545",
              "versionType": "git"
            },
            {
              "lessThan": "829e0c9f0855f26b3ae830d17b24aec103f7e915",
              "status": "affected",
              "version": "c8895e271f7994a3ecb13b8a280e39aa53879545",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/trace/trace_osnoise.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.14"
            },
            {
              "lessThan": "5.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.168",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.113",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.55",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.10.*",
              "status": "unaffected",
              "version": "6.10.14",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.11.*",
              "status": "unaffected",
              "version": "6.11.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.12",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.168",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.113",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.55",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10.14",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11.3",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntracing/timerlat: Fix a race during cpuhp processing\n\nThere is another found exception that the \"timerlat/1\" thread was\nscheduled on CPU0, and lead to timer corruption finally:\n\n```\nODEBUG: init active (active state 0) object: ffff888237c2e108 object type: hrtimer hint: timerlat_irq+0x0/0x220\nWARNING: CPU: 0 PID: 426 at lib/debugobjects.c:518 debug_print_object+0x7d/0xb0\nModules linked in:\nCPU: 0 UID: 0 PID: 426 Comm: timerlat/1 Not tainted 6.11.0-rc7+ #45\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014\nRIP: 0010:debug_print_object+0x7d/0xb0\n...\nCall Trace:\n \u003cTASK\u003e\n ? __warn+0x7c/0x110\n ? debug_print_object+0x7d/0xb0\n ? report_bug+0xf1/0x1d0\n ? prb_read_valid+0x17/0x20\n ? handle_bug+0x3f/0x70\n ? exc_invalid_op+0x13/0x60\n ? asm_exc_invalid_op+0x16/0x20\n ? debug_print_object+0x7d/0xb0\n ? debug_print_object+0x7d/0xb0\n ? __pfx_timerlat_irq+0x10/0x10\n __debug_object_init+0x110/0x150\n hrtimer_init+0x1d/0x60\n timerlat_main+0xab/0x2d0\n ? __pfx_timerlat_main+0x10/0x10\n kthread+0xb7/0xe0\n ? __pfx_kthread+0x10/0x10\n ret_from_fork+0x2d/0x40\n ? __pfx_kthread+0x10/0x10\n ret_from_fork_asm+0x1a/0x30\n \u003c/TASK\u003e\n```\n\nAfter tracing the scheduling event, it was discovered that the migration\nof the \"timerlat/1\" thread was performed during thread creation. Further\nanalysis confirmed that it is because the CPU online processing for\nosnoise is implemented through workers, which is asynchronous with the\noffline processing. When the worker was scheduled to create a thread, the\nCPU may has already been removed from the cpu_online_mask during the offline\nprocess, resulting in the inability to select the right CPU:\n\nT1                       | T2\n[CPUHP_ONLINE]           | cpu_device_down()\nosnoise_hotplug_workfn() |\n                         |     cpus_write_lock()\n                         |     takedown_cpu(1)\n                         |     cpus_write_unlock()\n[CPUHP_OFFLINE]          |\n    cpus_read_lock()     |\n    start_kthread(1)     |\n    cpus_read_unlock()   |\n\nTo fix this, skip online processing if the CPU is already offline."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Both halves of the race are driven purely through local file interfaces \u2014 enabling the osnoise/timerlat tracer via tracefs (`current_tracer`, `osnoise/cpus`) and cycling `/sys/devices/system/cpu/cpuN/online` \u2014 with no network- or peer-facing consumer of `osnoise_hotplug_workfn()`.\nAC:L - The attacker controls both sides of the race: keep timerlat registered so `osnoise_has_registered_instances()` passes, then repeatedly toggle a CPU offline/online so the deferred `osnoise_hotplug_work` is still blocked on `trace_types_lock`/`cpus_read_lock()` when `takedown_cpu()` clears the CPU from `cpu_online_mask`; the window is hit reliably by looping hotplug, and the required configs (`TIMERLAT_TRACER`, `HOTPLUG_CPU`) are standard in distro kernels.\nPR:L - No `capable()` check guards the path \u2014 access is governed only by file permissions on tracefs and the CPU-hotplug sysfs node, which are routinely relaxed via the tracefs `gid=` mount option for tracing groups, in privileged/`/sys`-rw containers, and on latency-tooling (rtla/HPC) hosts; additionally CPU offline/online cycles are generated without root by suspend/resume and hypervisor vCPU hotplug while an admin-started timerlat session runs.\nUI:N - The attacker drives the tracer enable and the CPU hotplug cycling directly in a loop; no victim must open a file, mount a filesystem, or take any other action.\nS:U - The corrupted objects \u2014 the per-CPU `hrtimer_cpu_base` timerqueue and a freed `task_struct` \u2014 live in the same kernel security authority as the triggering code; no VM, container, or IOMMU boundary is crossed.\nC:H - The misplaced timerlat kthread leaves `tlat-\u003ekthread` pointing at an exited, freed `task_struct` that `timerlat_irq()` dereferences via `wake_up_process()` from hardirq context, so freed slab contents are read and acted upon; combined with the corrupted hrtimer rbtree this is exploitable for kernel memory disclosure.\nI:H - `__hrtimer_init()` performs `memset(timer, 0, sizeof(struct hrtimer))` on an hrtimer still enqueued in CPU0\u0027s timerqueue, zeroing a live rb_node and the callback pointer, and the dangling `tlat-\u003ekthread` yields a use-after-free write into a reclaimed `task_struct` \u2014 memory corruption of a type leverageable for control-flow hijack via heap grooming.\nA:H - The bug reproduces as a `debug_print_object()` WARNING (\"init active object\" on `timerlat_irq`) and proceeds to timer corruption \u2014 a zeroed node left linked in the hrtimer rbtree plus a NULL `timer-\u003efunction` invoked from hardirq \u2014 producing oops/panic or a hung timer subsystem, and an immediate panic under `panic_on_warn`/`panic_on_oops`."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:40:14.365Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/322920b53dc11f9c2b33397eb3ae5bc6a175b60d"
        },
        {
          "url": "https://git.kernel.org/stable/c/ce25f33ba89d6eefef64157655d318444580fa14"
        },
        {
          "url": "https://git.kernel.org/stable/c/a6e9849063a6c8f4cb2f652a437e44e3ed24356c"
        },
        {
          "url": "https://git.kernel.org/stable/c/a0d9c0cd5856191e095cf43a2e141b73945b7716"
        },
        {
          "url": "https://git.kernel.org/stable/c/f72b451dc75578f644a3019c1489e9ae2c14e6c4"
        },
        {
          "url": "https://git.kernel.org/stable/c/829e0c9f0855f26b3ae830d17b24aec103f7e915"
        }
      ],
      "title": "tracing/timerlat: Fix a race during cpuhp processing",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-49866",
    "datePublished": "2024-10-21T18:01:09.284Z",
    "dateReserved": "2024-10-21T12:17:06.018Z",
    "dateUpdated": "2026-08-05T11:40:14.365Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-49866",
      "date": "2026-08-07",
      "epss": "0.00181",
      "percentile": "0.07818"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.14\", \"versionEndExcluding\": \"5.15.168\", \"matchCriteriaId\": \"5CD3CB21-008A-4AF9-9337-0FF92043AE5E\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.16\", \"versionEndExcluding\": \"6.1.113\", \"matchCriteriaId\": \"D01BD22E-ACD1-4618-9D01-6116570BE1EE\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.2\", \"versionEndExcluding\": \"6.6.55\", \"matchCriteriaId\": \"E90B9576-56C4-47BC-AAB0-C5B2D438F5D0\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.7\", \"versionEndExcluding\": \"6.10.14\", \"matchCriteriaId\": \"4C16BCE0-FFA0-4599-BE0A-1FD65101C021\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.11\", \"versionEndExcluding\": \"6.11.3\", \"matchCriteriaId\": \"54D9C704-D679-41A7-9C40-10A6B1E7FFE9\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.12:rc1:*:*:*:*:*:*\", \"matchCriteriaId\": \"7F361E1D-580F-4A2D-A509-7615F73167A1\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ntracing/timerlat: Fix a race during cpuhp processing\\n\\nThere is another found exception that the \\\"timerlat/1\\\" thread was\\nscheduled on CPU0, and lead to timer corruption finally:\\n\\n```\\nODEBUG: init active (active state 0) object: ffff888237c2e108 object type: hrtimer hint: timerlat_irq+0x0/0x220\\nWARNING: CPU: 0 PID: 426 at lib/debugobjects.c:518 debug_print_object+0x7d/0xb0\\nModules linked in:\\nCPU: 0 UID: 0 PID: 426 Comm: timerlat/1 Not tainted 6.11.0-rc7+ #45\\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014\\nRIP: 0010:debug_print_object+0x7d/0xb0\\n...\\nCall Trace:\\n \u003cTASK\u003e\\n ? __warn+0x7c/0x110\\n ? debug_print_object+0x7d/0xb0\\n ? report_bug+0xf1/0x1d0\\n ? prb_read_valid+0x17/0x20\\n ? handle_bug+0x3f/0x70\\n ? exc_invalid_op+0x13/0x60\\n ? asm_exc_invalid_op+0x16/0x20\\n ? debug_print_object+0x7d/0xb0\\n ? debug_print_object+0x7d/0xb0\\n ? __pfx_timerlat_irq+0x10/0x10\\n __debug_object_init+0x110/0x150\\n hrtimer_init+0x1d/0x60\\n timerlat_main+0xab/0x2d0\\n ? __pfx_timerlat_main+0x10/0x10\\n kthread+0xb7/0xe0\\n ? __pfx_kthread+0x10/0x10\\n ret_from_fork+0x2d/0x40\\n ? __pfx_kthread+0x10/0x10\\n ret_from_fork_asm+0x1a/0x30\\n \u003c/TASK\u003e\\n```\\n\\nAfter tracing the scheduling event, it was discovered that the migration\\nof the \\\"timerlat/1\\\" thread was performed during thread creation. Further\\nanalysis confirmed that it is because the CPU online processing for\\nosnoise is implemented through workers, which is asynchronous with the\\noffline processing. When the worker was scheduled to create a thread, the\\nCPU may has already been removed from the cpu_online_mask during the offline\\nprocess, resulting in the inability to select the right CPU:\\n\\nT1                       | T2\\n[CPUHP_ONLINE]           | cpu_device_down()\\nosnoise_hotplug_workfn() |\\n                         |     cpus_write_lock()\\n                         |     takedown_cpu(1)\\n                         |     cpus_write_unlock()\\n[CPUHP_OFFLINE]          |\\n    cpus_read_lock()     |\\n    start_kthread(1)     |\\n    cpus_read_unlock()   |\\n\\nTo fix this, skip online processing if the CPU is already offline.\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: tracing/timerlat: corrige una ejecuci\\u00f3n durante el procesamiento de cpuhp. Se encontr\\u00f3 otra excepci\\u00f3n: el hilo \\\"timerlat/1\\\" se program\\u00f3 en CPU0 y finalmente provoc\\u00f3 la corrupci\\u00f3n del temporizador: ``` ODEBUG: init active (active state 0) object: ffff888237c2e108 object type: hrtimer hint: timerlat_irq+0x0/0x220 WARNING: CPU: 0 PID: 426 at lib/debugobjects.c:518 debug_print_object+0x7d/0xb0 M\\u00f3dulos vinculados: CPU: 0 UID: 0 PID: 426 Comm: timerlat/1 No contaminado 6.11.0-rc7+ #45 Nombre del hardware: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 01/04/2014 RIP: 0010:debug_print_object+0x7d/0xb0 ... Seguimiento de llamadas:  ? __warn+0x7c/0x110 ? debug_print_object+0x7d/0xb0 ? report_bug+0xf1/0x1d0 ? prb_read_valid+0x17/0x20 ? handle_bug+0x3f/0x70 ? exc_invalid_op+0x13/0x60 ? asm_exc_invalid_op+0x16/0x20 ? debug_print_object+0x7d/0xb0 ? debug_print_object+0x7d/0xb0 ? ``` Despu\\u00e9s de rastrear el evento de programaci\\u00f3n, se descubri\\u00f3 que la migraci\\u00f3n del hilo \\\"timerlat/1\\\" se realiz\\u00f3 durante la creaci\\u00f3n del hilo. Un an\\u00e1lisis posterior confirm\\u00f3 que esto se debe a que el procesamiento en l\\u00ednea de la CPU para osnoise se implementa a trav\\u00e9s de trabajadores, que es asincr\\u00f3nico con el procesamiento fuera de l\\u00ednea. Cuando se program\\u00f3 el trabajador para crear un hilo, es posible que la CPU ya se haya eliminado de cpu_online_mask durante el proceso fuera de l\\u00ednea, lo que da como resultado la imposibilidad de seleccionar la CPU correcta: T1 | T2 [CPUHP_ONLINE] | cpu_device_down() osnoise_hotplug_workfn() | | cpus_write_lock() | takedown_cpu(1) | cpus_write_unlock() [CPUHP_OFFLINE] | cpus_read_lock() | start_kthread(1) | cpus_read_unlock() | Para solucionar esto, omita el procesamiento en l\\u00ednea si la CPU ya est\\u00e1 fuera de l\\u00ednea.\"}]",
      "id": "CVE-2024-49866",
      "lastModified": "2024-11-20T15:56:07.807",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"baseScore\": 4.7, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.0, \"impactScore\": 3.6}]}",
      "published": "2024-10-21T18:15:06.330",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/322920b53dc11f9c2b33397eb3ae5bc6a175b60d\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/829e0c9f0855f26b3ae830d17b24aec103f7e915\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/a0d9c0cd5856191e095cf43a2e141b73945b7716\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/a6e9849063a6c8f4cb2f652a437e44e3ed24356c\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/ce25f33ba89d6eefef64157655d318444580fa14\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/f72b451dc75578f644a3019c1489e9ae2c14e6c4\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Analyzed",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-362\"}]}]"
    },
    "microsoft_vex": {
      "current_release_date": "2026-02-18T14:45:16.000Z",
      "cve": "CVE-2024-49866",
      "id": "msrc_CVE-2024-49866",
      "initial_release_date": "2024-10-01T07:00:00.000Z",
      "product_status:fixed": "3",
      "product_status:known_affected": "3",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "tracing/timerlat: Fix a race during cpuhp processing",
      "url": "https://msrc.microsoft.com/csaf/vex/2024/msrc_cve-2024-49866.json",
      "version": "2"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-49866\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-10-21T18:15:06.330\",\"lastModified\":\"2026-08-04T11:20:53.673\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ntracing/timerlat: Fix a race during cpuhp processing\\n\\nThere is another found exception that the \\\"timerlat/1\\\" thread was\\nscheduled on CPU0, and lead to timer corruption finally:\\n\\n```\\nODEBUG: init active (active state 0) object: ffff888237c2e108 object type: hrtimer hint: timerlat_irq+0x0/0x220\\nWARNING: CPU: 0 PID: 426 at lib/debugobjects.c:518 debug_print_object+0x7d/0xb0\\nModules linked in:\\nCPU: 0 UID: 0 PID: 426 Comm: timerlat/1 Not tainted 6.11.0-rc7+ #45\\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014\\nRIP: 0010:debug_print_object+0x7d/0xb0\\n...\\nCall Trace:\\n \u003cTASK\u003e\\n ? __warn+0x7c/0x110\\n ? debug_print_object+0x7d/0xb0\\n ? report_bug+0xf1/0x1d0\\n ? prb_read_valid+0x17/0x20\\n ? handle_bug+0x3f/0x70\\n ? exc_invalid_op+0x13/0x60\\n ? asm_exc_invalid_op+0x16/0x20\\n ? debug_print_object+0x7d/0xb0\\n ? debug_print_object+0x7d/0xb0\\n ? __pfx_timerlat_irq+0x10/0x10\\n __debug_object_init+0x110/0x150\\n hrtimer_init+0x1d/0x60\\n timerlat_main+0xab/0x2d0\\n ? __pfx_timerlat_main+0x10/0x10\\n kthread+0xb7/0xe0\\n ? __pfx_kthread+0x10/0x10\\n ret_from_fork+0x2d/0x40\\n ? __pfx_kthread+0x10/0x10\\n ret_from_fork_asm+0x1a/0x30\\n \u003c/TASK\u003e\\n```\\n\\nAfter tracing the scheduling event, it was discovered that the migration\\nof the \\\"timerlat/1\\\" thread was performed during thread creation. Further\\nanalysis confirmed that it is because the CPU online processing for\\nosnoise is implemented through workers, which is asynchronous with the\\noffline processing. When the worker was scheduled to create a thread, the\\nCPU may has already been removed from the cpu_online_mask during the offline\\nprocess, resulting in the inability to select the right CPU:\\n\\nT1                       | T2\\n[CPUHP_ONLINE]           | cpu_device_down()\\nosnoise_hotplug_workfn() |\\n                         |     cpus_write_lock()\\n                         |     takedown_cpu(1)\\n                         |     cpus_write_unlock()\\n[CPUHP_OFFLINE]          |\\n    cpus_read_lock()     |\\n    start_kthread(1)     |\\n    cpus_read_unlock()   |\\n\\nTo fix this, skip online processing if the CPU is already offline.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: tracing/timerlat: corrige una ejecuci\u00f3n durante el procesamiento de cpuhp. Se encontr\u00f3 otra excepci\u00f3n: el hilo \\\"timerlat/1\\\" se program\u00f3 en CPU0 y finalmente provoc\u00f3 la corrupci\u00f3n del temporizador: ``` ODEBUG: init active (active state 0) object: ffff888237c2e108 object type: hrtimer hint: timerlat_irq+0x0/0x220 WARNING: CPU: 0 PID: 426 at lib/debugobjects.c:518 debug_print_object+0x7d/0xb0 M\u00f3dulos vinculados: CPU: 0 UID: 0 PID: 426 Comm: timerlat/1 No contaminado 6.11.0-rc7+ #45 Nombre del hardware: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 01/04/2014 RIP: 0010:debug_print_object+0x7d/0xb0 ... Seguimiento de llamadas:  ? __warn+0x7c/0x110 ? debug_print_object+0x7d/0xb0 ? report_bug+0xf1/0x1d0 ? prb_read_valid+0x17/0x20 ? handle_bug+0x3f/0x70 ? exc_invalid_op+0x13/0x60 ? asm_exc_invalid_op+0x16/0x20 ? debug_print_object+0x7d/0xb0 ? debug_print_object+0x7d/0xb0 ? ``` Despu\u00e9s de rastrear el evento de programaci\u00f3n, se descubri\u00f3 que la migraci\u00f3n del hilo \\\"timerlat/1\\\" se realiz\u00f3 durante la creaci\u00f3n del hilo. Un an\u00e1lisis posterior confirm\u00f3 que esto se debe a que el procesamiento en l\u00ednea de la CPU para osnoise se implementa a trav\u00e9s de trabajadores, que es asincr\u00f3nico con el procesamiento fuera de l\u00ednea. Cuando se program\u00f3 el trabajador para crear un hilo, es posible que la CPU ya se haya eliminado de cpu_online_mask durante el proceso fuera de l\u00ednea, lo que da como resultado la imposibilidad de seleccionar la CPU correcta: T1 | T2 [CPUHP_ONLINE] | cpu_device_down() osnoise_hotplug_workfn() | | cpus_write_lock() | takedown_cpu(1) | cpus_write_unlock() [CPUHP_OFFLINE] | cpus_read_lock() | start_kthread(1) | cpus_read_unlock() | Para solucionar esto, omita el procesamiento en l\u00ednea si la CPU ya est\u00e1 fuera de l\u00ednea.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"kernel/trace/trace_osnoise.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"c8895e271f7994a3ecb13b8a280e39aa53879545\",\"lessThan\":\"322920b53dc11f9c2b33397eb3ae5bc6a175b60d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"c8895e271f7994a3ecb13b8a280e39aa53879545\",\"lessThan\":\"ce25f33ba89d6eefef64157655d318444580fa14\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"c8895e271f7994a3ecb13b8a280e39aa53879545\",\"lessThan\":\"a6e9849063a6c8f4cb2f652a437e44e3ed24356c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"c8895e271f7994a3ecb13b8a280e39aa53879545\",\"lessThan\":\"a0d9c0cd5856191e095cf43a2e141b73945b7716\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"c8895e271f7994a3ecb13b8a280e39aa53879545\",\"lessThan\":\"f72b451dc75578f644a3019c1489e9ae2c14e6c4\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"c8895e271f7994a3ecb13b8a280e39aa53879545\",\"lessThan\":\"829e0c9f0855f26b3ae830d17b24aec103f7e915\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"kernel/trace/trace_osnoise.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.14\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.14\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.168\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.113\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.55\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.10.14\",\"lessThanOrEqual\":\"6.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.11.3\",\"lessThanOrEqual\":\"6.11.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":4.7,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.0,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-10-22T13:47:35.638203Z\",\"id\":\"CVE-2024-49866\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-362\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.14\",\"versionEndExcluding\":\"5.15.168\",\"matchCriteriaId\":\"5CD3CB21-008A-4AF9-9337-0FF92043AE5E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.113\",\"matchCriteriaId\":\"D01BD22E-ACD1-4618-9D01-6116570BE1EE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.55\",\"matchCriteriaId\":\"E90B9576-56C4-47BC-AAB0-C5B2D438F5D0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.10.14\",\"matchCriteriaId\":\"4C16BCE0-FFA0-4599-BE0A-1FD65101C021\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.11\",\"versionEndExcluding\":\"6.11.3\",\"matchCriteriaId\":\"54D9C704-D679-41A7-9C40-10A6B1E7FFE9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.12:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"7F361E1D-580F-4A2D-A509-7615F73167A1\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/322920b53dc11f9c2b33397eb3ae5bc6a175b60d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/829e0c9f0855f26b3ae830d17b24aec103f7e915\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a0d9c0cd5856191e095cf43a2e141b73945b7716\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a6e9849063a6c8f4cb2f652a437e44e3ed24356c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ce25f33ba89d6eefef64157655d318444580fa14\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f72b451dc75578f644a3019c1489e9ae2c14e6c4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-08-04T22:41:08+00:00",
      "cve": "CVE-2024-49866",
      "id": "CVE-2024-49866",
      "initial_release_date": "2024-10-21T00:00:00+00:00",
      "product_status:known_affected": "156",
      "product_status:known_not_affected": "42",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: tracing/timerlat: Fix a race during cpuhp processing",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-49866.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-07-25T01:33:16Z",
      "cve": "CVE-2024-49866",
      "id": "CVE-2024-49866",
      "initial_release_date": "2024-10-25T03:07:36Z",
      "product_status:known_affected": "426",
      "product_status:known_not_affected": "233",
      "product_status:recommended": "642",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-49866",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-49866.json",
      "version": "64"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-11-03T22:22:33.052Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-49866\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-10-22T13:47:35.638203Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-10-22T13:47:38.748Z\"}}], \"cna\": {\"title\": \"tracing/timerlat: Fix a race during cpuhp processing\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"c8895e271f7994a3ecb13b8a280e39aa53879545\", \"lessThan\": \"322920b53dc11f9c2b33397eb3ae5bc6a175b60d\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"c8895e271f7994a3ecb13b8a280e39aa53879545\", \"lessThan\": \"ce25f33ba89d6eefef64157655d318444580fa14\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"c8895e271f7994a3ecb13b8a280e39aa53879545\", \"lessThan\": \"a6e9849063a6c8f4cb2f652a437e44e3ed24356c\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"c8895e271f7994a3ecb13b8a280e39aa53879545\", \"lessThan\": \"a0d9c0cd5856191e095cf43a2e141b73945b7716\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"c8895e271f7994a3ecb13b8a280e39aa53879545\", \"lessThan\": \"f72b451dc75578f644a3019c1489e9ae2c14e6c4\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"c8895e271f7994a3ecb13b8a280e39aa53879545\", \"lessThan\": \"829e0c9f0855f26b3ae830d17b24aec103f7e915\", \"versionType\": \"git\"}], \"programFiles\": [\"kernel/trace/trace_osnoise.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.14\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.14\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.15.168\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.113\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.55\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.10.14\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.10.*\"}, {\"status\": \"unaffected\", \"version\": \"6.11.3\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.11.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"kernel/trace/trace_osnoise.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/322920b53dc11f9c2b33397eb3ae5bc6a175b60d\"}, {\"url\": \"https://git.kernel.org/stable/c/ce25f33ba89d6eefef64157655d318444580fa14\"}, {\"url\": \"https://git.kernel.org/stable/c/a6e9849063a6c8f4cb2f652a437e44e3ed24356c\"}, {\"url\": \"https://git.kernel.org/stable/c/a0d9c0cd5856191e095cf43a2e141b73945b7716\"}, {\"url\": \"https://git.kernel.org/stable/c/f72b451dc75578f644a3019c1489e9ae2c14e6c4\"}, {\"url\": \"https://git.kernel.org/stable/c/829e0c9f0855f26b3ae830d17b24aec103f7e915\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ntracing/timerlat: Fix a race during cpuhp processing\\n\\nThere is another found exception that the \\\"timerlat/1\\\" thread was\\nscheduled on CPU0, and lead to timer corruption finally:\\n\\n```\\nODEBUG: init active (active state 0) object: ffff888237c2e108 object type: hrtimer hint: timerlat_irq+0x0/0x220\\nWARNING: CPU: 0 PID: 426 at lib/debugobjects.c:518 debug_print_object+0x7d/0xb0\\nModules linked in:\\nCPU: 0 UID: 0 PID: 426 Comm: timerlat/1 Not tainted 6.11.0-rc7+ #45\\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014\\nRIP: 0010:debug_print_object+0x7d/0xb0\\n...\\nCall Trace:\\n \u003cTASK\u003e\\n ? __warn+0x7c/0x110\\n ? debug_print_object+0x7d/0xb0\\n ? report_bug+0xf1/0x1d0\\n ? prb_read_valid+0x17/0x20\\n ? handle_bug+0x3f/0x70\\n ? exc_invalid_op+0x13/0x60\\n ? asm_exc_invalid_op+0x16/0x20\\n ? debug_print_object+0x7d/0xb0\\n ? debug_print_object+0x7d/0xb0\\n ? __pfx_timerlat_irq+0x10/0x10\\n __debug_object_init+0x110/0x150\\n hrtimer_init+0x1d/0x60\\n timerlat_main+0xab/0x2d0\\n ? __pfx_timerlat_main+0x10/0x10\\n kthread+0xb7/0xe0\\n ? __pfx_kthread+0x10/0x10\\n ret_from_fork+0x2d/0x40\\n ? __pfx_kthread+0x10/0x10\\n ret_from_fork_asm+0x1a/0x30\\n \u003c/TASK\u003e\\n```\\n\\nAfter tracing the scheduling event, it was discovered that the migration\\nof the \\\"timerlat/1\\\" thread was performed during thread creation. Further\\nanalysis confirmed that it is because the CPU online processing for\\nosnoise is implemented through workers, which is asynchronous with the\\noffline processing. When the worker was scheduled to create a thread, the\\nCPU may has already been removed from the cpu_online_mask during the offline\\nprocess, resulting in the inability to select the right CPU:\\n\\nT1                       | T2\\n[CPUHP_ONLINE]           | cpu_device_down()\\nosnoise_hotplug_workfn() |\\n                         |     cpus_write_lock()\\n                         |     takedown_cpu(1)\\n                         |     cpus_write_unlock()\\n[CPUHP_OFFLINE]          |\\n    cpus_read_lock()     |\\n    start_kthread(1)     |\\n    cpus_read_unlock()   |\\n\\nTo fix this, skip online processing if the CPU is already offline.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.168\", \"versionStartIncluding\": \"5.14\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.113\", \"versionStartIncluding\": \"5.14\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.55\", \"versionStartIncluding\": \"5.14\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.10.14\", \"versionStartIncluding\": \"5.14\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.11.3\", \"versionStartIncluding\": \"5.14\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12\", \"versionStartIncluding\": \"5.14\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-05-11T20:40:44.796Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-49866\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-05-11T20:40:44.796Z\", \"dateReserved\": \"2024-10-21T12:17:06.018Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-10-21T18:01:09.284Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.