{"id":"CVE-2024-49935","state":"PUBLISHED","title":"ACPI: PAD: fix crash in exit_round_robin()","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nACPI: PAD: fix crash in exit_round_robin()\n\nThe kernel occasionally crashes in cpumask_clear_cpu(), which is called\nwithin exit_round_robin(), because when executing clear_bit(nr, addr) with\nnr set to 0xffffffff, the address calculation may cause misalignment within\nthe memory, leading to access to an invalid memory address.\n\n----------\nBUG: unable to handle kernel paging request at ffffffffe0740618\n        ...\nCPU: 3 PID: 2919323 Comm: acpi_pad/14 Kdump: loaded Tainted: G           OE  X --------- -  - 4.18.0-425.19.2.el8_7.x86_64 #1\n        ...\nRIP: 0010:power_saving_thread+0x313/0x411 [acpi_pad]\nCode: 89 cd 48 89 d3 eb d1 48 c7 c7 55 70 72 c0 e8 64 86 b0 e4 c6 05 0d a1 02 00 01 e9 bc fd ff ff 45 89 e4 42 8b 04 a5 20 82 72 c0 <f0> 48 0f b3 05 f4 9c 01 00 42 c7 04 a5 20 82 72 c0 ff ff ff ff 31\nRSP: 0018:ff72a5d51fa77ec8 EFLAGS: 00010202\nRAX: 00000000ffffffff RBX: ff462981e5d8cb80 RCX: 0000000000000000\nRDX: 0000000000000000 RSI: 0000000000000246 RDI: 0000000000000246\nRBP: ff46297556959d80 R08: 0000000000000382 R09: ff46297c8d0f38d8\nR10: 0000000000000000 R11: 0000000000000001 R12: 000000000000000e\nR13: 0000000000000000 R14: ffffffffffffffff R15: 000000000000000e\nFS:  0000000000000000(0000) GS:ff46297a800c0000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: ffffffffe0740618 CR3: 0000007e20410004 CR4: 0000000000771ee0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nPKRU: 55555554\nCall Trace:\n ? acpi_pad_add+0x120/0x120 [acpi_pad]\n kthread+0x10b/0x130\n ? set_kthread_struct+0x50/0x50\n ret_from_fork+0x1f/0x40\n        ...\nCR2: ffffffffe0740618\n\ncrash> dis -lr ffffffffc0726923\n        ...\n/usr/src/debug/kernel-4.18.0-425.19.2.el8_7/linux-4.18.0-425.19.2.el8_7.x86_64/./include/linux/cpumask.h: 114\n0xffffffffc0726918 <power_saving_thread+776>:\tmov    %r12d,%r12d\n/usr/src/debug/kernel-4.18.0-425.19.2.el8_7/linux-4.18.0-425.19.2.el8_7.x86_64/./include/linux/cpumask.h: 325\n0xffffffffc072691b <power_saving_thread+779>:\tmov    -0x3f8d7de0(,%r12,4),%eax\n/usr/src/debug/kernel-4.18.0-425.19.2.el8_7/linux-4.18.0-425.19.2.el8_7.x86_64/./arch/x86/include/asm/bitops.h: 80\n0xffffffffc0726923 <power_saving_thread+787>:\tlock btr %rax,0x19cf4(%rip)        # 0xffffffffc0740620 <pad_busy_cpus_bits>\n\ncrash> px tsk_in_cpu[14]\n$66 = 0xffffffff\n\ncrash> px 0xffffffffc072692c+0x19cf4\n$99 = 0xffffffffc0740620\n\ncrash> sym 0xffffffffc0740620\nffffffffc0740620 (b) pad_busy_cpus_bits [acpi_pad]\n\ncrash> px pad_busy_cpus_bits[0]\n$42 = 0xfffc0\n----------\n\nTo fix this, ensure that tsk_in_cpu[tsk_index] != -1 before calling\ncpumask_clear_cpu() in exit_round_robin(), just as it is done in\nround_robin_cpu().\n\n[ rjw: Subject edit, avoid updates to the same value ]","publishedAt":"2024-10-21T18:01:56.404Z","updatedAt":"2026-05-11T20:42:16.304Z","severity":null,"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"8e0af5141ab950b78b3ebbfaded5439dcf8b3a8d","status":"affected","lessThan":"82191a21a0dedc8c64e14f07f5d568d09bc4b331","versionType":"git"},{"version":"8e0af5141ab950b78b3ebbfaded5439dcf8b3a8d","status":"affected","lessThan":"d214ffa6eb39c08d18a460124dd7ba318dc56f33","versionType":"git"},{"version":"8e0af5141ab950b78b3ebbfaded5439dcf8b3a8d","status":"affected","lessThan":"92e5661b7d0727ab912b76625a88b33fdb9b609a","versionType":"git"},{"version":"8e0af5141ab950b78b3ebbfaded5439dcf8b3a8d","status":"affected","lessThan":"68a599da16ebad442ce295d8d2d5c488e3992822","versionType":"git"},{"version":"8e0af5141ab950b78b3ebbfaded5439dcf8b3a8d","status":"affected","lessThan":"68a8e45743d6a120f863fb14b72dc59616597019","versionType":"git"},{"version":"8e0af5141ab950b78b3ebbfaded5439dcf8b3a8d","status":"affected","lessThan":"03593dbb0b272ef7b0358b099841e65735422aca","versionType":"git"},{"version":"8e0af5141ab950b78b3ebbfaded5439dcf8b3a8d","status":"affected","lessThan":"27c045f868f0e5052c6b532868a65e0cd250c8fc","versionType":"git"},{"version":"8e0af5141ab950b78b3ebbfaded5439dcf8b3a8d","status":"affected","lessThan":"0a2ed70a549e61c5181bad5db418d223b68ae932","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/acpi/acpi_pad.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"2.6.32","status":"affected"},{"version":"0","status":"unaffected","lessThan":"2.6.32","versionType":"semver"},{"version":"5.4.296","status":"unaffected","lessThanOrEqual":"5.4.*","versionType":"semver"},{"version":"5.10.240","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.168","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.113","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.55","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.10.14","status":"unaffected","lessThanOrEqual":"6.10.*","versionType":"semver"},{"version":"6.11.3","status":"unaffected","lessThanOrEqual":"6.11.*","versionType":"semver"},{"version":"6.12","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/acpi/acpi_pad.c"]}],"references":["https://git.kernel.org/stable/c/82191a21a0dedc8c64e14f07f5d568d09bc4b331","https://git.kernel.org/stable/c/d214ffa6eb39c08d18a460124dd7ba318dc56f33","https://git.kernel.org/stable/c/92e5661b7d0727ab912b76625a88b33fdb9b609a","https://git.kernel.org/stable/c/68a599da16ebad442ce295d8d2d5c488e3992822","https://git.kernel.org/stable/c/68a8e45743d6a120f863fb14b72dc59616597019","https://git.kernel.org/stable/c/03593dbb0b272ef7b0358b099841e65735422aca","https://git.kernel.org/stable/c/27c045f868f0e5052c6b532868a65e0cd250c8fc","https://git.kernel.org/stable/c/0a2ed70a549e61c5181bad5db418d223b68ae932","https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html","https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"],"weaknesses":[],"ingestedAt":"2026-10-29T20:07:56.516Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/49xxx/CVE-2024-49935.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2024-49935","state":"PUBLISHED","datePublished":"2024-10-21T18:01:56.404Z","dateUpdated":"2026-05-11T20:42:16.304Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2024-10-21T12:17:06.042Z"},"containers":{"cna":{"title":"ACPI: PAD: fix crash in exit_round_robin()","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nACPI: PAD: fix crash in exit_round_robin()\n\nThe kernel occasionally crashes in cpumask_clear_cpu(), which is called\nwithin exit_round_robin(), because when executing clear_bit(nr, addr) with\nnr set to 0xffffffff, the address calculation may cause misalignment within\nthe memory, leading to access to an invalid memory address.\n\n----------\nBUG: unable to handle kernel paging request at ffffffffe0740618\n        ...\nCPU: 3 PID: 2919323 Comm: acpi_pad/14 Kdump: loaded Tainted: G           OE  X --------- -  - 4.18.0-425.19.2.el8_7.x86_64 #1\n        ...\nRIP: 0010:power_saving_thread+0x313/0x411 [acpi_pad]\nCode: 89 cd 48 89 d3 eb d1 48 c7 c7 55 70 72 c0 e8 64 86 b0 e4 c6 05 0d a1 02 00 01 e9 bc fd ff ff 45 89 e4 42 8b 04 a5 20 82 72 c0 <f0> 48 0f b3 05 f4 9c 01 00 42 c7 04 a5 20 82 72 c0 ff ff ff ff 31\nRSP: 0018:ff72a5d51fa77ec8 EFLAGS: 00010202\nRAX: 00000000ffffffff RBX: ff462981e5d8cb80 RCX: 0000000000000000\nRDX: 0000000000000000 RSI: 0000000000000246 RDI: 0000000000000246\nRBP: ff46297556959d80 R08: 0000000000000382 R09: ff46297c8d0f38d8\nR10: 0000000000000000 R11: 0000000000000001 R12: 000000000000000e\nR13: 0000000000000000 R14: ffffffffffffffff R15: 000000000000000e\nFS:  0000000000000000(0000) GS:ff46297a800c0000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: ffffffffe0740618 CR3: 0000007e20410004 CR4: 0000000000771ee0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nPKRU: 55555554\nCall Trace:\n ? acpi_pad_add+0x120/0x120 [acpi_pad]\n kthread+0x10b/0x130\n ? set_kthread_struct+0x50/0x50\n ret_from_fork+0x1f/0x40\n        ...\nCR2: ffffffffe0740618\n\ncrash> dis -lr ffffffffc0726923\n        ...\n/usr/src/debug/kernel-4.18.0-425.19.2.el8_7/linux-4.18.0-425.19.2.el8_7.x86_64/./include/linux/cpumask.h: 114\n0xffffffffc0726918 <power_saving_thread+776>:\tmov    %r12d,%r12d\n/usr/src/debug/kernel-4.18.0-425.19.2.el8_7/linux-4.18.0-425.19.2.el8_7.x86_64/./include/linux/cpumask.h: 325\n0xffffffffc072691b <power_saving_thread+779>:\tmov    -0x3f8d7de0(,%r12,4),%eax\n/usr/src/debug/kernel-4.18.0-425.19.2.el8_7/linux-4.18.0-425.19.2.el8_7.x86_64/./arch/x86/include/asm/bitops.h: 80\n0xffffffffc0726923 <power_saving_thread+787>:\tlock btr %rax,0x19cf4(%rip)        # 0xffffffffc0740620 <pad_busy_cpus_bits>\n\ncrash> px tsk_in_cpu[14]\n$66 = 0xffffffff\n\ncrash> px 0xffffffffc072692c+0x19cf4\n$99 = 0xffffffffc0740620\n\ncrash> sym 0xffffffffc0740620\nffffffffc0740620 (b) pad_busy_cpus_bits [acpi_pad]\n\ncrash> px pad_busy_cpus_bits[0]\n$42 = 0xfffc0\n----------\n\nTo fix this, ensure that tsk_in_cpu[tsk_index] != -1 before calling\ncpumask_clear_cpu() in exit_round_robin(), just as it is done in\nround_robin_cpu().\n\n[ rjw: Subject edit, avoid updates to the same value ]"}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"8e0af5141ab950b78b3ebbfaded5439dcf8b3a8d","status":"affected","lessThan":"82191a21a0dedc8c64e14f07f5d568d09bc4b331","versionType":"git"},{"version":"8e0af5141ab950b78b3ebbfaded5439dcf8b3a8d","status":"affected","lessThan":"d214ffa6eb39c08d18a460124dd7ba318dc56f33","versionType":"git"},{"version":"8e0af5141ab950b78b3ebbfaded5439dcf8b3a8d","status":"affected","lessThan":"92e5661b7d0727ab912b76625a88b33fdb9b609a","versionType":"git"},{"version":"8e0af5141ab950b78b3ebbfaded5439dcf8b3a8d","status":"affected","lessThan":"68a599da16ebad442ce295d8d2d5c488e3992822","versionType":"git"},{"version":"8e0af5141ab950b78b3ebbfaded5439dcf8b3a8d","status":"affected","lessThan":"68a8e45743d6a120f863fb14b72dc59616597019","versionType":"git"},{"version":"8e0af5141ab950b78b3ebbfaded5439dcf8b3a8d","status":"affected","lessThan":"03593dbb0b272ef7b0358b099841e65735422aca","versionType":"git"},{"version":"8e0af5141ab950b78b3ebbfaded5439dcf8b3a8d","status":"affected","lessThan":"27c045f868f0e5052c6b532868a65e0cd250c8fc","versionType":"git"},{"version":"8e0af5141ab950b78b3ebbfaded5439dcf8b3a8d","status":"affected","lessThan":"0a2ed70a549e61c5181bad5db418d223b68ae932","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/acpi/acpi_pad.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"2.6.32","status":"affected"},{"version":"0","status":"unaffected","lessThan":"2.6.32","versionType":"semver"},{"version":"5.4.296","status":"unaffected","lessThanOrEqual":"5.4.*","versionType":"semver"},{"version":"5.10.240","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.168","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.113","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.55","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.10.14","status":"unaffected","lessThanOrEqual":"6.10.*","versionType":"semver"},{"version":"6.11.3","status":"unaffected","lessThanOrEqual":"6.11.*","versionType":"semver"},{"version":"6.12","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/acpi/acpi_pad.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/82191a21a0dedc8c64e14f07f5d568d09bc4b331"},{"url":"https://git.kernel.org/stable/c/d214ffa6eb39c08d18a460124dd7ba318dc56f33"},{"url":"https://git.kernel.org/stable/c/92e5661b7d0727ab912b76625a88b33fdb9b609a"},{"url":"https://git.kernel.org/stable/c/68a599da16ebad442ce295d8d2d5c488e3992822"},{"url":"https://git.kernel.org/stable/c/68a8e45743d6a120f863fb14b72dc59616597019"},{"url":"https://git.kernel.org/stable/c/03593dbb0b272ef7b0358b099841e65735422aca"},{"url":"https://git.kernel.org/stable/c/27c045f868f0e5052c6b532868a65e0cd250c8fc"},{"url":"https://git.kernel.org/stable/c/0a2ed70a549e61c5181bad5db418d223b68ae932"}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-05-11T20:42:16.304Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.32","versionEndExcluding":"5.4.296"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.32","versionEndExcluding":"5.10.240"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.32","versionEndExcluding":"5.15.168"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.32","versionEndExcluding":"6.1.113"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.32","versionEndExcluding":"6.6.55"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.32","versionEndExcluding":"6.10.14"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.32","versionEndExcluding":"6.11.3"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.32","versionEndExcluding":"6.12"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2024-49935","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2024-10-22T13:38:31.252329Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-10-22T13:38:51.383Z"}},{"title":"CVE Program Container","references":[{"url":"https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"},{"url":"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2025-11-03T22:23:19.179Z"}}]}}}