CVE-2024-44981: 
Linux Kernel vulnerability analysis and mitigation

CVE-2024-44981 is a vulnerability in the Linux kernel's workqueue subsystem that involves an integer subtraction overflow error in the shiftandmask() function. The issue was discovered when booting in a virtual machine on Android, where UBSAN (Undefined Behavior Sanitizer) reported a subtraction overflow error. The vulnerability affects Linux kernel versions from 6.10 up to (excluding) 6.10.7, as well as various release candidates of version 6.11 (NVD).

The vulnerability occurs in the shiftandmask() function where a signed immediate is used to construct the mask when called with a shift of 31 (WORKOFFQPOOLSHIFT), resulting in a decrement from INTMIN. The issue manifests as a UBSAN 'subtraction overflow' error during system boot. The vulnerability has been assigned a CVSS v3.1 base score of 5.5 (Medium) with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (NVD).

The vulnerability can lead to a kernel panic with the message 'UBSAN: integer subtraction overflow: Fatal exception' when the affected code path is triggered. This results in a system crash, affecting the availability of the system (Kernel Patch).

The vulnerability has been fixed by using an unsigned constant '1U' to generate the mask in the shiftandmask() function. The fix has been implemented in the kernel source code through patches. Users are recommended to upgrade to patched versions of the Linux kernel (Kernel Patch).