Skip to content
Fencer Vulns
medium 4.7

CVE-2024-56547 json

rcu/nocb: Fix missed RCU barrier on deoffloading

published 2024-12-27 22 mo ago modified 2026-06-17 4 mo ago also EUVD-2024-53195

cvss
4.7
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
0.2%
EPSS 0.2% chance of exploitation in 30 days, percentile 10%
public exploits
0
none known

Summary

In the Linux kernel, the following vulnerability has been resolved:

rcu/nocb: Fix missed RCU barrier on deoffloading

Currently, running rcutorture test with torture_type=rcu fwd_progress=8 n_barrier_cbs=8 nocbs_nthreads=8 nocbs_toggle=100 onoff_interval=60 test_boost=2, will trigger the following warning:

WARNING: CPU: 19 PID: 100 at kernel/rcu/tree_nocb.h:1061 rcu_nocb_rdp_deoffload+0x292/0x2a0 RIP: 0010:rcu_nocb_rdp_deoffload+0x292/0x2a0 Call Trace: <TASK> ? __warn+0x7e/0x120 ? rcu_nocb_rdp_deoffload+0x292/0x2a0 ? report_bug+0x18e/0x1a0 ? handle_bug+0x3d/0x70 ? exc_invalid_op+0x18/0x70 ? asm_exc_invalid_op+0x1a/0x20 ? rcu_nocb_rdp_deoffload+0x292/0x2a0 rcu_nocb_cpu_deoffload+0x70/0xa0 rcu_nocb_toggle+0x136/0x1c0 ? __pfx_rcu_nocb_toggle+0x10/0x10 kthread+0xd1/0x100 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x2f/0x50 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30 </TASK>

CPU0 CPU2 CPU3 //rcu_nocb_toggle //nocb_cb_wait //rcutorture

// deoffload CPU1 // process CPU1's rdp rcu_barrier() rcu_segcblist_entrain() rcu_segcblist_add_len(1); // len == 2 // enqueue barrier // callback to CPU1's // rdp->cblist rcu_do_batch() // invoke CPU1's rdp->cblist // callback rcu_barrier_callback() rcu_barrier() mutex_lock(&rcu_state.barrier_mutex); // still see len == 2 // enqueue barrier callback // to CPU1's rdp->cblist rcu_segcblist_entrain() rcu_segcblist_add_len(1); // len == 3 // decrement len rcu_segcblist_add_len(-2); kthread_parkme()

// CPU1's rdp->cblist len == 1 // Warn because there is // still a pending barrier // trigger warning WARN_ON_ONCE(rcu_segcblist_n_cbs(&rdp->cblist)); cpus_read_unlock();

// wait CPU1 to comes online and // invoke barrier callback on // CPU1 rdp's->cblist wait_for_completion(&rcu_state.barrier_completion); // deoffload CPU4 cpus_read_lock() rcu_barrier() mutex_lock(&rcu_state.barrier_mutex); // block on barrier_mutex // wait rcu_barrier() on // CPU3 to unlock barrier_mutex // but CPU3 unlock barrier_mutex // need to wait CPU1 comes online // when CPU1 going online will block on cpus_write_lock

The above scenario will not only trigger a WARN_ON_ONCE(), but also trigger a deadlock.

Thanks to nocb locking, a second racing rcu_barrier() on an offline CPU will either observe the decremented callback counter down to 0 and spare the callback enqueue, or rcuo will observe the new callback and keep rdp->nocb_cb_sleep to false.

Therefore check rdp->nocb_cb_sleep before parking to make sure no further rcu_barrier() is waiting on the rdp.

Patch / fix

  • Linux Linux 6.12.2, 6.13
  • linux Debian 14, Debian 13 6.12.3-1

debian advisories DEBIAN-CVE-2024-56547

  • kernel enterprise linux eus 10.0 6.12.0-55.76.1.el10_0
  • rv enterprise linux eus 10.0 6.12.0-55.76.1.el10_0
  • perf enterprise linux eus 10.0 6.12.0-55.76.1.el10_0
  • rtla enterprise linux eus 10.0 6.12.0-55.76.1.el10_0
  • libperf enterprise linux eus 10.0 6.12.0-55.76.1.el10_0
  • kernel-rt enterprise linux eus 10.0 6.12.0-55.76.1.el10_0
  • kernel-64k enterprise linux eus 10.0 6.12.0-55.76.1.el10_0
  • kernel-core enterprise linux eus 10.0 6.12.0-55.76.1.el10_0

red hat advisories RHSA-2026:22334

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2024-56547 updated

kernel: rcu/nocb: Fix missed RCU barrier on deoffloading

  • Red Hat Enterprise Linux 10 kernel
    affected: no fix available
  • Red Hat Enterprise Linux AppStream EUS (v. 10.0) rv 6.12.0-55.76.1.el10_0, perf 6.12.0-55.76.1.el10_0, rtla 6.12.0-55.76.1.el10_0, python3-perf 6.12.0-55.76.1.el10_0, kernel-devel-matched 6.12.0-55.76.1.el10_0, kernel-64k-devel-matched 6.12.0-55.76.1.el10_0, +7 more Red Hat Enterprise Linux BaseOS EUS (v. 10.0) kernel 6.12.0-55.76.1.el10_0, kernel-64k 6.12.0-55.76.1.el10_0, kernel-core 6.12.0-55.76.1.el10_0, kernel-tools 6.12.0-55.76.1.el10_0, kernel-modules 6.12.0-55.76.1.el10_0, kernel-64k-core 6.12.0-55.76.1.el10_0, +27 more Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0) libperf 6.12.0-55.76.1.el10_0, kernel-debuginfo-common-s390x 6.12.0-55.76.1.el10_0, kernel-debuginfo-common-x86_64 6.12.0-55.76.1.el10_0, kernel-debuginfo-common-aarch64 6.12.0-55.76.1.el10_0, kernel-debuginfo-common-ppc64le 6.12.0-55.76.1.el10_0 Red Hat Enterprise Linux Real Time EUS (v. 10.0) kernel-rt 6.12.0-55.76.1.el10_0, kernel-rt-64k 6.12.0-55.76.1.el10_0, kernel-rt-core 6.12.0-55.76.1.el10_0, kernel-rt-modules 6.12.0-55.76.1.el10_0, kernel-rt-64k-core 6.12.0-55.76.1.el10_0, kernel-rt-debug-core 6.12.0-55.76.1.el10_0, +14 more Red Hat Enterprise Linux Real Time for NFV EUS (v. 10.0) kernel-rt 6.12.0-55.76.1.el10_0, kernel-rt-kvm 6.12.0-55.76.1.el10_0, kernel-rt-core 6.12.0-55.76.1.el10_0, kernel-rt-modules 6.12.0-55.76.1.el10_0, kernel-rt-debug-kvm 6.12.0-55.76.1.el10_0, kernel-rt-debug-core 6.12.0-55.76.1.el10_0, +6 more
    fixed: vendor fix RHSA-2026:22334
  • Red Hat Enterprise Linux 6 perf, kernel, python-perf, kernel-kdump, kernel-firmware, kernel-bootwrapper, +1 more Red Hat Enterprise Linux 7 perf, kernel, bpftool, kernel-rt, python-perf, kernel-kdump, +8 more Red Hat Enterprise Linux 8 perf, kernel, bpftool, kernel-rt, kernel-core, kernel-tools, +29 more Red Hat Enterprise Linux 9 rv, perf, rtla, kernel, bpftool, libperf, +83 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

0.21% chance of exploitation in the next 30 days, higher than 10% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.1 4.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

  • Linux Linux

Classification

Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.