Skip to content
Fencer Vulns
medium 5.5

CVE-2024-27006 json

thermal/debugfs: Add missing count increment to thermal_debug_tz_trip_up()

published 2024-05-01 2 y ago modified 2026-06-17 4 mo ago also EUVD-2024-24268

cvss
5.5
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
0.2%
EPSS 0.2% chance of exploitation in 30 days, percentile 13%
public exploits
0
none known

Summary

In the Linux kernel, the following vulnerability has been resolved:

thermal/debugfs: Add missing count increment to thermal_debug_tz_trip_up()

The count field in struct trip_stats, representing the number of times the zone temperature was above the trip point, needs to be incremented in thermal_debug_tz_trip_up(), for two reasons.

First, if a trip point is crossed on the way up for the first time, thermal_debug_update_temp() called from update_temperature() does not see it because it has not been added to trips_crossed[] array in the thermal zone's struct tz_debugfs object yet. Therefore, when thermal_debug_tz_trip_up() is called after that, the trip point's count value is 0, and the attempt to divide by it during the average temperature computation leads to a divide error which causes the kernel to crash. Setting the count to 1 before the division by incrementing it fixes this problem.

Second, if a trip point is crossed on the way up, but it has been crossed on the way up already before, its count value needs to be incremented to make a record of the fact that the zone temperature is above the trip now. Without doing that, if the mitigations applied after crossing the trip cause the zone temperature to drop below its threshold, the count will not be updated for this episode at all and the average temperature in the trip statistics record will be somewhat higher than it should be.

Cc :6.8+ <stable@vger.kernel.org> # 6.8+

Patch / fix

  • Linux Linux 6.8.8, 6.9
  • linux Debian 14, Debian 13 6.8.9-1

debian advisories DEBIAN-CVE-2024-27006

  • linux Ubuntu 24.04 LTS 6.8.0-38.38
  • linux-aws Ubuntu 24.04 LTS 6.8.0-1011.12
  • linux-gcp Ubuntu 24.04 LTS 6.8.0-1010.11
  • linux-gke Ubuntu 24.04 LTS 6.8.0-1006.9
  • linux-ibm Ubuntu 24.04 LTS 6.8.0-1008.8
  • linux-azure Ubuntu 24.04 LTS 6.8.0-1010.10
  • linux-intel Ubuntu 24.04 LTS 6.8.0-1007.14
  • linux-raspi Ubuntu 24.04 LTS 6.8.0-1007.7

ubuntu advisories UBUNTU-CVE-2024-27006

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2024-27006 updated cvss 5.5

kernel: thermal/debugfs: Add missing count increment to thermal_debug_tz_trip_up()

  • Red Hat Enterprise Linux 7 perf, kernel, bpftool, kernel-rt, python-perf, kernel-kdump, +8 more
    affected: workaround, no fix planned “Out of support scope”
  • Red Hat Enterprise Linux 6 perf, kernel, python-perf, kernel-kdump, kernel-firmware, kernel-bootwrapper, +1 more Red Hat Enterprise Linux 8 perf, kernel, bpftool, kernel-rt, kernel-core, kernel-tools, +29 more Red Hat Enterprise Linux 9 rv, perf, rtla, kernel, bpftool, libperf, +83 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
2 y ago

Exploit prediction

0.23% chance of exploitation in the next 30 days, higher than 13% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.1 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

  • Linux Linux

Classification

Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.