{
  "schema_version": "1.6.1",
  "id": "RPI-CVE-2024-49866",
  "modified": "2026-10-09T11:39:44Z",
  "upstream": [
    "CVE-2024-49866"
  ],
  "published": "2024-10-21T18:02:47Z",
  "summary": "tracing/timerlat: Fix a race during cpuhp processing",
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ntracing/timerlat: Fix a race during cpuhp processing\n\nThere is another found exception that the \"timerlat/1\" thread was\nscheduled on CPU0, and lead to timer corruption finally:\n\n```\nODEBUG: init active (active state 0) object: ffff888237c2e108 object type: hrtimer hint: timerlat_irq+0x0/0x220\nWARNING: CPU: 0 PID: 426 at lib/debugobjects.c:518 debug_print_object+0x7d/0xb0\nModules linked in:\nCPU: 0 UID: 0 PID: 426 Comm: timerlat/1 Not tainted 6.11.0-rc7+ #45\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014\nRIP: 0010:debug_print_object+0x7d/0xb0\n...\nCall Trace:\n <TASK>\n ? __warn+0x7c/0x110\n ? debug_print_object+0x7d/0xb0\n ? report_bug+0xf1/0x1d0\n ? prb_read_valid+0x17/0x20\n ? handle_bug+0x3f/0x70\n ? exc_invalid_op+0x13/0x60\n ? asm_exc_invalid_op+0x16/0x20\n ? debug_print_object+0x7d/0xb0\n ? debug_print_object+0x7d/0xb0\n ? __pfx_timerlat_irq+0x10/0x10\n __debug_object_init+0x110/0x150\n hrtimer_init+0x1d/0x60\n timerlat_main+0xab/0x2d0\n ? __pfx_timerlat_main+0x10/0x10\n kthread+0xb7/0xe0\n ? __pfx_kthread+0x10/0x10\n ret_from_fork+0x2d/0x40\n ? __pfx_kthread+0x10/0x10\n ret_from_fork_asm+0x1a/0x30\n </TASK>\n```\n\nAfter tracing the scheduling event, it was discovered that the migration\nof the \"timerlat/1\" thread was performed during thread creation. Further\nanalysis confirmed that it is because the CPU online processing for\nosnoise is implemented through workers, which is asynchronous with the\noffline processing. When the worker was scheduled to create a thread, the\nCPU may has already been removed from the cpu_online_mask during the offline\nprocess, resulting in the inability to select the right CPU:\n\nT1                       | T2\n[CPUHP_ONLINE]           | cpu_device_down()\nosnoise_hotplug_workfn() |\n                         |     cpus_write_lock()\n                         |     takedown_cpu(1)\n                         |     cpus_write_unlock()\n[CPUHP_OFFLINE]          |\n    cpus_read_lock()     |\n    start_kthread(1)     |\n    cpus_read_unlock()   |\n\nTo fix this, skip online processing if the CPU is already offline.",
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
    }
  ],
  "affected": [
    {
      "package": {
        "ecosystem": "Raspberry Pi OS:12",
        "name": "linux"
      },
      "versions": [
        "1:6.1.47-1+rpt4"
      ],
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-2712",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v6",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v7",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v7l",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v8",
            "binary_version": "1:6.1.47-1+rpt4"
          }
        ]
      },
      "database_specific": {
        "per_version": {
          "1:6.1.47-1+rpt4": {
            "linux_commit": "655fc658a15ae7a6f37103754adb39ba52a9a14e",
            "upstream_version": "6.1.47",
            "assessment": "commit ancestry (strak rule)",
            "upstream_fixed": "6.1.113",
            "compiled_filter": false
          }
        }
      }
    }
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-49866"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/322920b53dc11f9c2b33397eb3ae5bc6a175b60d"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/ce25f33ba89d6eefef64157655d318444580fa14"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/a6e9849063a6c8f4cb2f652a437e44e3ed24356c"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/a0d9c0cd5856191e095cf43a2e141b73945b7716"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/f72b451dc75578f644a3019c1489e9ae2c14e6c4"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/829e0c9f0855f26b3ae830d17b24aec103f7e915"
    }
  ],
  "database_specific": {
    "source": "https://git.kernel.org/pub/scm/linux/security/vulns.git",
    "upstream_modified": "2026-08-05T11:52:36Z",
    "severity": {
      "source": "kernel CNA",
      "cvss_v3_score": 7.8,
      "cvss_v3_severity": "High",
      "scenario": "AV:L - Both halves of the race are driven purely through local file interfaces \u2014 enabling the osnoise/timerlat tracer via tracefs (`current_tracer`, `osnoise/cpus`) and cycling `/sys/devices/system/cpu/cpuN/online` \u2014 with no network- or peer-facing consumer of `osnoise_hotplug_workfn()`.\nAC:L - The attacker controls both sides of the race: keep timerlat registered so `osnoise_has_registered_instances()` passes, then repeatedly toggle a CPU offline/online so the deferred `osnoise_hotplug_work` is still blocked on `trace_types_lock`/`cpus_read_lock()` when `takedown_cpu()` clears the CPU from `cpu_online_mask`; the window is hit reliably by looping hotplug, and the required configs (`TIMERLAT_TRACER`, `HOTPLUG_CPU`) are standard in distro kernels.\nPR:L - No `capable()` check guards the path \u2014 access is governed only by file permissions on tracefs and the CPU-hotplug sysfs node, which are routinely relaxed via the tracefs `gid=` mount option for tracing groups, in privileged/`/sys`-rw containers, and on latency-tooling (rtla/HPC) hosts; additionally CPU offline/online cycles are generated without root by suspend/resume and hypervisor vCPU hotplug while an admin-started timerlat session runs.\nUI:N - The attacker drives the tracer enable and the CPU hotplug cycling directly in a loop; no victim must open a file, mount a filesystem, or take any other action.\nS:U - The corrupted objects \u2014 the per-CPU `hrtimer_cpu_base` timerqueue and a freed `task_struct` \u2014 live in the same kernel security authority as the triggering code; no VM, container, or IOMMU boundary is crossed.\nC:H - The misplaced timerlat kthread leaves `tlat->kthread` pointing at an exited, freed `task_struct` that `timerlat_irq()` dereferences via `wake_up_process()` from hardirq context, so freed slab contents are read and acted upon; combined with the corrupted hrtimer rbtree this is exploitable for kernel memory disclosure.\nI:H - `__hrtimer_init()` performs `memset(timer, 0, sizeof(struct hrtimer))` on an hrtimer still enqueued in CPU0's timerqueue, zeroing a live rb_node and the callback pointer, and the dangling `tlat->kthread` yields a use-after-free write into a reclaimed `task_struct` \u2014 memory corruption of a type leverageable for control-flow hijack via heap grooming.\nA:H - The bug reproduces as a `debug_print_object()` WARNING (\"init active object\" on `timerlat_irq`) and proceeds to timer corruption \u2014 a zeroed node left linked in the hrtimer rbtree plus a NULL `timer->function` invoked from hardirq \u2014 producing oops/panic or a hung timer subsystem, and an immediate panic under `panic_on_warn`/`panic_on_oops`."
    }
  }
}