CVE-2024-41932 sched: fix warning in sched_setaffinity
A race condition in the Linux kernel scheduler triggers a warning when task affinity conflicts with cpuset updates, potentially causing system instability.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-41932?
CVE-2024-41932 is a medium-severity vulnerability in Linux kernel, published on 11 Jan 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
sched: fix warning in sched_setaffinity
Commit 8f9ea86fdf99b added some logic to sched_setaffinity that included a WARN when a per-task affinity assignment races with a cpuset update.
Specifically, we can have a race where a cpuset update results in the task affinity no longer being a subset of the cpuset. That's fine; we have a fallback to instead use the cpuset mask. However, we have a WARN set up that will trigger if the cpuset mask has no overlap at all with the requested task affinity. This shouldn't be a warning condition; its trivial to create this condition.
Reproduced the warning by the following setup:
- $PID inside a cpuset cgroup - another thread repeatedly switching the cpuset cpus from 1-2 to just 1 - another thread repeatedly setting the $PID affinity (via taskset) to 2
Which versions are affected by CVE-2024-41932?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2024-41932?
Apply the vendor's patch.
Is CVE-2024-41932 being exploited?
There is no known exploitation of CVE-2024-41932 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-62645, BELL-CVE-2024-41932, DEBIAN-CVE-2024-41932, GHSA-r78q-c787-rf79, UBUNTU-CVE-2024-41932.