CVE-2024-27004

Q: What is the severity of CVE-2024-27004?

CVE-2024-27004 has a CVSS score of 5.5 (MEDIUM). This CVE describes a deadlock vulnerability in the Linux kernel's clock framework where the clk_disable_unused function could cause a system hang. The issue occurs when two threads attempt to acquire locks in opposite order during runtime power management operations, leading to a complete system freeze. This affects Linux systems with specific hardware configurations that trigger the clock tree operations during boot or device probing.

5.5 MEDIUM

Denial of Service

📋 TL;DR

This CVE describes a deadlock vulnerability in the Linux kernel's clock framework where the clk_disable_unused function could cause a system hang. The issue occurs when two threads attempt to acquire locks in opposite order during runtime power management operations, leading to a complete system freeze. This affects Linux systems with specific hardware configurations that trigger the clock tree operations during boot or device probing.

💻 Affected Systems

Products:

Linux kernel

Versions: Multiple versions including 5.15.149 and others before fixes were applied

Operating Systems: Linux distributions using affected kernel versions

Default Config Vulnerable: ⚠️ Yes

Notes: Requires specific hardware configurations that trigger clock tree operations during runtime power management. More likely on systems with complex clock trees and power management.

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

Learn more about Linux Kernel →

Linux Kernel by Linux

Learn more about Linux Kernel →

Linux Kernel by Linux

Learn more about Linux Kernel →

Linux Kernel by Linux

Learn more about Linux Kernel →

Linux Kernel by Linux

Learn more about Linux Kernel →

Linux Kernel by Linux

Learn more about Linux Kernel →

Linux Kernel by Linux

Learn more about Linux Kernel →

Linux Kernel by Linux

Learn more about Linux Kernel →

Linux Kernel by Linux

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete system hang requiring hard reboot, potentially causing data loss or service disruption.

🟠

Likely Case

System hangs during boot or device initialization, requiring manual intervention to restart.

🟢

If Mitigated

Minor performance impact from additional runtime PM checks, no security compromise.

🌐 Internet-Facing: LOW - This is a local deadlock issue not directly exploitable over network.

🏢 Internal Only: MEDIUM - Can cause system instability and service disruption on affected Linux servers.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: NO

Unauthenticated Exploit: ✅ No

Complexity: HIGH - Requires specific hardware/software conditions to trigger deadlock

This is a reliability issue rather than a security vulnerability that can be actively exploited. The deadlock occurs under specific timing conditions during system operations.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Multiple stable kernel versions with commit 115554862294397590088ba02f11f2aba6d5016c and related fixes

Vendor Advisory: https://git.kernel.org/stable/c/115554862294397590088ba02f11f2aba6d5016c

Restart Required: Yes

Instructions:

1. Update Linux kernel to patched version from your distribution. 2. For custom kernels, apply commit 115554862294397590088ba02f11f2aba6d5016c. 3. Reboot system to load new kernel.

🔧 Temporary Workarounds

Disable deferred probe workqueue

linux

Prevent the deadlock by disabling the deferred probe mechanism that triggers the conflicting operations

echo N > /sys/module/driver/parameters/deferred_probe_timeout

Increase hung task timeout

linux

Reduce impact by allowing system more time to recover from deadlock

echo 300 > /proc/sys/kernel/hung_task_timeout_secs

🧯 If You Can't Patch

Monitor system for hung tasks and implement automated recovery procedures
Avoid hardware configurations that trigger complex clock tree operations during runtime PM

🔍 How to Verify

Check if Vulnerable:

Check kernel version and if system experiences hangs during boot with 'clk_disable_unused' in stack traces

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version includes the fix commit and monitor for absence of deadlocks during system operations

📡 Detection & Monitoring

Log Indicators:

Kernel messages showing 'hung task' with clk_disable_unused in call trace
System logs showing boot failures or device initialization hangs

Network Indicators:

None - this is a local system issue

SIEM Query:

source="kernel" AND "hung task" AND "clk_disable_unused"

📊 Metadata

CVE ID: CVE-2024-27004

CVSS v3 Score: 5.5 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE: CWE-667

Published: May 1, 2024

Last Updated: December 23, 2025

📋 TL;DR

💻 Affected Systems

📦 What is this software?

Debian Linux by Debian

Fedora by Fedoraproject

Fedora by Fedoraproject

Fedora by Fedoraproject

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

⚠️ Risk & Real-World Impact

Worst Case

Likely Case

If Mitigated

🎯 Exploit Status

🛠️ Fix & Mitigation

✅ Official Fix

Instructions:

🔧 Temporary Workarounds

Disable deferred probe workqueue

Increase hung task timeout

🧯 If You Can't Patch

🔍 How to Verify

Check if Vulnerable:

Check Version:

Verify Fix Applied:

📡 Detection & Monitoring

Log Indicators:

Network Indicators:

SIEM Query:

📊 Metadata

🔗 References

📤 Share & Export

🔗 Related Vulnerabilities