CVE-2024-44975: 
Linux Kernel vulnerability analysis and mitigation

CVE-2024-44975 affects the Linux kernel's cgroup/cpuset subsystem. The vulnerability was discovered in September 2024 and involves a panic caused by partcmd_update in the cgroup/cpuset functionality. The issue affects Linux kernel versions from 6.7 up to (excluding) 6.10.7, as well as release candidates 6.11-rc1 through 6.11-rc4 (NVD).

The vulnerability is caused by incorrect rebuilding of scheduling domains when handling cpuset partition updates. When calling update_parent_effective_cpumask with partcmd_update, if newmask is not null, the system fails to properly recheck whether CPUs are available for parent/cs that has tasks. This can lead to a kernel panic with a page fault error (Kernel Patch). The vulnerability has been assigned a CVSS v3.1 base score of 5.5 (Medium) with vector: AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (NVD).

When successfully exploited, this vulnerability can cause a kernel panic, resulting in a denial of service condition. This affects system availability and stability (NVD).

The vulnerability can be triggered through local access by manipulating cgroup filesystem operations. A proof-of-concept exists that demonstrates the issue using specific commands in the /sys/fs/cgroup/ directory (Kernel Patch).

The vulnerability has been patched in the Linux kernel. The fix involves adding additional checks in the update_parent_effective_cpumask function to verify CPU availability for parent/cs when processing newmask updates. Users should update to patched kernel versions (Kernel Patch).