{"id":"CVE-2024-57951","revision":null,"records":[{"revision":"6be39a52e42b441b8e93475cf407ca9c","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2024-57951","aliases":[],"title":"hrtimers: Handle CPU state correctly on hotplug","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nhrtimers: Handle CPU state correctly on hotplug\n\nConsider a scenario where a CPU transitions from CPUHP_ONLINE to halfway\nthrough a CPU hotunplug down to CPUHP_HRTIMERS_PREPARE, and then back to\nCPUHP_ONLINE:\n\nSince hrtimers_prepare_cpu() does not run, cpu_base.hres_active remains set\nto 1 throughout. However, during a CPU unplug operation, the tick and the\nclockevents are shut down at CPUHP_AP_TICK_DYING. On return to the online\nstate, for instance CFS incorrectly assumes that the hrtick is already\nactive, and the chance of the clockevent device to transition to oneshot\nmode is also lost forever for the CPU, unless it goes back to a lower state\nthan CPUHP_HRTIMERS_PREPARE once.\n\nThis round-trip reveals another issue; cpu_base.online is not set to 1\nafter the transition, which appears as a WARN_ON_ONCE in enqueue_hrtimer().\n\nAside of that, the bulk of the per CPU state is not reset either, which\nmeans there are dangling pointers in the worst case.\n\nAddress this by adding a corresponding startup() callback, which resets the\nstale per CPU state and sets the online flag.\n\n[ tglx: Make the new callback unconditionally available, remove the online\n \tmodification in the prepare() callback and clear the remaining\n \tstate in the starting callback instead of the prepare callback ]","state":0,"publishedAt":"2025-02-12T13:27:53.124+00:00","modifiedAt":"2026-10-15T01:01:03.578+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n \"product\": \"Linux\",\n \"vendor\": \"Linux\",\n \"defaultStatus\": \"unaffected\",\n \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n \"programFiles\": [\n \"include/linux/hrtimer.h\",\n \"kernel/cpu.c\",\n \"kernel/time/hrtimer.c\"\n ],\n \"versions\": [\n {\n \"version\": \"54d0d83a53508d687fd4a225f8aa1f18559562d0\",\n \"lessThan\": \"95e4f62df23f4df1ce6ef897d44b8e23c260921a\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"7f4c89400d2997939f6971c7981cc780a219e36b\",\n \"lessThan\": \"14984139f1f2768883332965db566ef26db609e7\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"6fcbcc6c8e52650749692c7613cbe71bf601670d\",\n \"lessThan\": \"15b453db41d36184cf0ccc21e7df624014ab6a1a\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"75b5016ce325f1ef9c63e5398a1064cf8a7a7354\",\n \"lessThan\": \"3d41dbf82e10c44e53ea602398ab002baec27e75\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"53f408cad05bb987af860af22f4151e5a18e6ee8\",\n \"lessThan\": \"a5cbbea145b400e40540c34816d16d36e0374fbc\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"5c0930ccaad5a74d74e8b18b648c5eb21ed2fe94\",\n \"lessThan\": \"38492f6ee883c7b1d33338bf531a62cff69b4b28\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"5c0930ccaad5a74d74e8b18b648c5eb21ed2fe94\",\n \"lessThan\": \"2f8dea1692eef2b7ba6a256246ed82c365fdc686\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"9a2fc41acb69dd4e2a58d0c04346c3333c2341fc\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"5.4.264\",\n \"lessThan\": \"5.4.290\",\n \"status\": \"affected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"5.10.204\",\n \"lessThan\": \"5.10.234\",\n \"status\": \"affected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"5.15.143\",\n \"lessThan\": \"5.15.177\",\n \"status\": \"affected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"6.1.68\",\n \"lessThan\": \"6.1.127\",\n \"status\": \"affected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"6.6.7\",\n \"lessThan\": \"6.6.74\",\n \"status\": \"affected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"4.19.302\",\n \"lessThan\": \"4.20\",\n \"status\": \"affected\",\n \"versionType\": \"semver\"\n }\n ]\n }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n \"product\": \"Linux\",\n \"vendor\": \"Linux\",\n \"defaultStatus\": \"affected\",\n \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n \"programFiles\": [\n \"include/linux/hrtimer.h\",\n \"kernel/cpu.c\",\n \"kernel/time/hrtimer.c\"\n ],\n \"versions\": [\n {\n \"version\": \"6.7\",\n \"status\": \"affected\"\n },\n {\n \"version\": \"0\",\n \"lessThan\": \"6.7\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"5.4.290\",\n \"lessThanOrEqual\": \"5.4.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"5.10.234\",\n \"lessThanOrEqual\": \"5.10.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"5.15.177\",\n \"lessThanOrEqual\": \"5.15.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"6.1.127\",\n \"lessThanOrEqual\": \"6.1.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"6.6.74\",\n \"lessThanOrEqual\": \"6.6.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"6.12.11\",\n \"lessThanOrEqual\": \"6.12.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"6.13\",\n \"lessThanOrEqual\": \"*\",\n \"status\": \"unaffected\",\n \"versionType\": \"original_commit_for_fix\"\n }\n ]\n }"}],"metrics":[],"references":["https://git.kernel.org/stable/c/95e4f62df23f4df1ce6ef897d44b8e23c260921a","https://git.kernel.org/stable/c/14984139f1f2768883332965db566ef26db609e7","https://git.kernel.org/stable/c/15b453db41d36184cf0ccc21e7df624014ab6a1a","https://git.kernel.org/stable/c/3d41dbf82e10c44e53ea602398ab002baec27e75","https://git.kernel.org/stable/c/a5cbbea145b400e40540c34816d16d36e0374fbc","https://git.kernel.org/stable/c/38492f6ee883c7b1d33338bf531a62cff69b4b28","https://git.kernel.org/stable/c/2f8dea1692eef2b7ba6a256246ed82c365fdc686"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2024-57951","license":"CVE Program Terms of Use","key":"cve-program:CVE-2024-57951","identifiers":["CVE-2024-57951"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-09T20:04:25.0077254+00:00","complete":true,"records":1772,"lastAttemptAt":"2026-11-09T20:04:25.0077254+00:00","lastSuccessAt":"2026-11-09T20:04:25.1926568+00:00","error":null,"lastVerifiedAt":"2026-11-09T20:04:25.192657+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-24e6fde7b744113daefb8f6135035fb8a5c69c9617c9c0d40574a0376532ffd3-4a9560b8b58726018512a0a26f2f2de094eec0a9257ebc797e76aa7229628f6d","complete":true,"records":421528,"lastAttemptAt":"2026-11-09T20:02:23.7922996+00:00","lastSuccessAt":"2026-11-09T20:02:23.6346925+00:00","error":null,"lastVerifiedAt":"2026-11-09T20:02:23.7922996+00:00","snapshotPublishedAt":"2026-11-09T19:26:49+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-7062dd6d7628421ab96b6fad5e9e5783","complete":false,"records":13655,"lastAttemptAt":"2026-11-09T20:16:49.2041123+00:00","lastSuccessAt":"2026-11-09T20:16:49.199+00:00","error":"9 identifier lookups failed; latest failures include HTTP 403. Other identifiers were checked independently.","lastVerifiedAt":"2026-11-09T20:16:49.199+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13314,"expectedIdentifiers":13707,"failedIdentifiers":9},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-09T20:04:25.0077254+00:00","complete":true,"records":1096,"lastAttemptAt":"2026-11-09T20:04:25.0077254+00:00","lastSuccessAt":"2026-11-09T20:04:25.193761+00:00","error":null,"lastVerifiedAt":"2026-11-09T20:04:25.1937612+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-9938fd6291bf40d68f5b1fd395158ad4","complete":true,"records":13667,"lastAttemptAt":"2026-11-09T20:04:38.0577664+00:00","lastSuccessAt":"2026-11-09T20:04:38.055+00:00","error":null,"lastVerifiedAt":"2026-11-09T20:04:38.055+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13707,"expectedIdentifiers":13707,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-980593e6977a6d1b4fb1eed5a1ffe88a468736f89f0a06f710924ad59132c023","complete":true,"records":9914,"lastAttemptAt":"2026-11-09T20:04:24.9600639+00:00","lastSuccessAt":"2026-11-08T11:07:07.068788+00:00","error":null,"lastVerifiedAt":"2026-11-09T20:04:24.9600639+00:00","snapshotPublishedAt":"2026-11-08T11:02:46+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-712163772d637a9cfaa34d4241efb9e9d0ccd6149596c672c613d362f44af841","complete":true,"records":1971,"lastAttemptAt":"2026-11-09T20:02:23.9593912+00:00","lastSuccessAt":"2026-11-09T18:02:23.0088273+00:00","error":null,"lastVerifiedAt":"2026-11-09T20:02:23.9593912+00:00","snapshotPublishedAt":"2026-11-09T17:03:01+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-761ecc9061239b0da572dc9254c6f384c1d19339eb08408c436647a2f26129e9","complete":true,"records":3064,"lastAttemptAt":"2026-11-09T20:04:24.9750181+00:00","lastSuccessAt":"2026-11-09T17:05:03.4044794+00:00","error":null,"lastVerifiedAt":"2026-11-09T20:04:24.9750181+00:00","snapshotPublishedAt":"2026-11-09T16:33:20+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-604a3d0f2ac3a85e07b87120f064f717efb18ea8fa81b2bec8e0f33ba949fa25","complete":true,"records":231321,"lastAttemptAt":"2026-11-09T20:04:24.8172812+00:00","lastSuccessAt":"2026-11-09T20:04:23.3062045+00:00","error":null,"lastVerifiedAt":"2026-11-09T20:04:24.8172812+00:00","snapshotPublishedAt":"2026-11-09T19:33:14+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}