CVE-2024-57951

Q: What is the severity of CVE-2024-57951?

CVE-2024-57951 has a CVSS score of 7.8 (HIGH). A Linux kernel vulnerability in the hrtimers subsystem allows improper handling of CPU state during hotplug operations. This can lead to system instability, denial of service, or potential privilege escalation through dangling pointers. All Linux systems using affected kernel versions are vulnerable.

7.8 HIGH

Denial of Service

📋 TL;DR

A Linux kernel vulnerability in the hrtimers subsystem allows improper handling of CPU state during hotplug operations. This can lead to system instability, denial of service, or potential privilege escalation through dangling pointers. All Linux systems using affected kernel versions are vulnerable.

💻 Affected Systems

Products:

Linux kernel

Versions: Specific affected versions not explicitly stated in CVE description, but references indicate multiple stable kernel versions are affected

Operating Systems: All Linux distributions using affected kernel versions

Default Config Vulnerable: ⚠️ Yes

Notes: Requires CPU hotplug capability and appropriate permissions to trigger the vulnerable state transition.

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

System crash, kernel panic, or privilege escalation through use-after-free of dangling pointers leading to arbitrary code execution in kernel context.

🟠

Likely Case

System instability, CPU scheduling issues, or denial of service due to incorrect timer handling and WARN_ON_ONCE triggers.

🟢

If Mitigated

Minor performance impact or occasional warnings in kernel logs if proper isolation and monitoring are in place.

🌐 Internet-Facing: LOW - Requires local access to trigger CPU hotplug operations.

🏢 Internal Only: MEDIUM - Local users or processes with sufficient privileges could trigger the condition through CPU hotplug operations.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Exploitation requires local access and ability to trigger CPU hotplug operations. The dangling pointers could potentially be leveraged for privilege escalation.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Multiple stable kernel versions with fixes referenced in git commits

Vendor Advisory: https://git.kernel.org/stable/c/14984139f1f2768883332965db566ef26db609e7

Restart Required: Yes

Instructions:

1. Update to a patched kernel version from your distribution vendor. 2. Reboot the system to load the new kernel. 3. Verify the fix is applied by checking kernel version.

🔧 Temporary Workarounds

Disable CPU hotplug

all

Prevent CPU hotplug operations that trigger the vulnerable state transition

echo 0 > /sys/devices/system/cpu/cpuX/online (for each CPU)
Add 'maxcpus=1' to kernel boot parameters to disable hotplug

🧯 If You Can't Patch

Restrict local user access and limit permissions for CPU hotplug operations
Implement strict monitoring for kernel warnings and system instability indicators

🔍 How to Verify

Check if Vulnerable:

Check kernel version against affected versions from distribution security advisories. Look for kernel warnings related to hrtimers or CPU hotplug in dmesg.

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version is updated to a patched version. Monitor system logs for absence of hrtimer-related warnings after CPU hotplug operations.

📡 Detection & Monitoring

Log Indicators:

WARN_ON_ONCE messages in kernel logs related to enqueue_hrtimer()
CPU hotplug operation logs followed by system instability

Network Indicators:

None - local vulnerability only

SIEM Query:

source="kernel" AND ("WARN_ON_ONCE" OR "hrtimer" OR "CPU hotplug")

📊 Metadata

CVE ID: CVE-2024-57951

CVSS v3 Score: 7.8 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-416

EPSS Score: 0.04% exploit probability (10.6th percentile)

Published: February 12, 2025

Last Updated: November 3, 2025

📋 TL;DR

💻 Affected Systems

📦 What is this software?

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

⚠️ Risk & Real-World Impact

Worst Case

Likely Case

If Mitigated

🎯 Exploit Status

🛠️ Fix & Mitigation

✅ Official Fix

Instructions:

🔧 Temporary Workarounds

Disable CPU hotplug

🧯 If You Can't Patch

🔍 How to Verify

Check if Vulnerable:

Check Version:

Verify Fix Applied:

📡 Detection & Monitoring

Log Indicators:

Network Indicators:

SIEM Query:

📊 Metadata

🔗 References

📤 Share & Export

🔗 Related Vulnerabilities