CVE-2024-57951hrtimers: Handle CPU state correctly on hotplug
Updated under an hour ago ()
Does this affect you?
It affects Linux and 5 other products. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: hrtimers: Handle CPU state correctly on hotplug Consider a scenario where a CPU transitions from CPUHP_ONLINE to halfway through a CPU hotunplug down to CPUHP_HRTIMERS_PREPARE, and then back to CPUHP_ONLINE: Since hrtimers_prepare_cpu() does not run, cpu_base.hres_active remains set to 1 throughout. However, during a CPU unplug operation, the tick and the clockevents are shut down at CPUHP_AP_TICK_DYING. On return to the online state, for instance CFS incorrectly assumes that the hrtick is already active, and the chance of the clockevent device to transition to oneshot mode is also lost forever for the CPU, unless it goes back to a lower state than CPUHP_HRTIMERS_PREPARE once. This round-trip reveals another issue; cpu_base.online is not set to 1 after the transition, which appears as a WARN_ON_ONCE in enqueue_hrtimer(). Aside of that, the bulk of the per CPU state is not reset either, which means there are dangling pointers in the worst case. Address this by adding a corresponding startup() callback, which resets the stale per CPU state and sets the online flag. [ tglx: Make the new callback unconditionally available, remove the online modification in the prepare() callback and clear the remaining state in the starting callback instead of the prepare callback ]
- CVSS
- 7.8 HIGH (v3.1, CISA ADP)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- CWE-416
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Modified
- Record last updated
- Oct 15, 2026
- First seen by InfoSec Signals
- Oct 15, 2026
Affected products
Linux Linux linux:linux (from the name) | from 54d0d83a53508d687fd4a225f8aa1f18559562d0 before 95e4f62df23f4df1ce6ef897d44b8e23c260921a; from 7f4c89400d2997939f6971c7981cc780a219e36b before 14984139f1f2768883332965db566ef26db609e7; from 6fcbcc6c8e52650749692c7613cbe71bf601670d before 15b453db41d36184cf0ccc21e7df624014ab6a1a; 75b5016ce325f1ef9c63e5398a1064cf8a7a7354 builds before 3d41dbf82e10c44e53ea602398ab002baec27e75; from 53f408cad05bb987af860af22f4151e5a18e6ee8 before a5cbbea145b400e40540c34816d16d36e0374fbc; from 5c0930ccaad5a74d74e8b18b648c5eb21ed2fe94 before 38492f6ee883c7b1d33338bf531a62cff69b4b28; 5c0930ccaad5a74d74e8b18b648c5eb21ed2fe94 builds before 2f8dea1692eef2b7ba6a256246ed82c365fdc686; 9a2fc41acb69dd4e2a58d0c04346c3333c2341fc; and 6 more ranges | CNA record |
Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem siemens:simatic_s7_1500_tm_mfp_gnu_linux_subsystem (from the name) | before V1.1.1 | CISA ADP |
Siemens RUGGEDCOM RST2428P siemens:ruggedcom_rst2428p (from the name) | before V3.2 | CISA ADP |
Siemens SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family siemens:scalance_xc_300_xr_300_xc_400_xr_500wg_xr_500_family (from the name) | before V3.2 | CISA ADP |
Siemens SCALANCE XCM-/XRM-/XCH-/XRH-300 family siemens:scalance_xcm_xrm_xch_xrh_300_family (from the name) | before V3.2 | CISA ADP |
linux linux_kernel linux:linux_kernel | from 4.19.302 before 4.20; from 5.4.264 before 5.4.290; from 5.10.204 before 5.10.234; from 5.15.143 before 5.15.177; from 6.1.68 before 6.1.127; from 6.6.7 before 6.6.74; from 6.7 before 6.12.11; 6.13; and 6 more ranges | NVD |
References
- https://git.kernel.org/stable/c/95e4f62df23f4df1ce6ef897d44b8e23c260921apatch
- https://git.kernel.org/stable/c/14984139f1f2768883332965db566ef26db609e7patch
- https://git.kernel.org/stable/c/15b453db41d36184cf0ccc21e7df624014ab6a1apatch
- https://git.kernel.org/stable/c/3d41dbf82e10c44e53ea602398ab002baec27e75patch
- https://git.kernel.org/stable/c/a5cbbea145b400e40540c34816d16d36e0374fbcpatch
- https://git.kernel.org/stable/c/38492f6ee883c7b1d33338bf531a62cff69b4b28patch
- https://git.kernel.org/stable/c/2f8dea1692eef2b7ba6a256246ed82c365fdc686patch
- https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html
- https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html
- https://cert-portal.siemens.com/productcert/html/ssa-265688.html
- https://cert-portal.siemens.com/productcert/html/ssa-355557.html
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.