{
  "cveId": "CVE-2024-36888",
  "url": "https://patchblox.com/security/cve/CVE-2024-36888",
  "summary": "CVE-2024-36888 is fixed in linux on 1 platform, first by DEBIAN-CVE-2024-36888, released May 30, 2024. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "linux: In the Linux kernel, the following vulnerability has been resolved:  workqueue: Fix selection of wake_cpu in kick_poo...",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  workqueue: Fix selection of wake_cpu in kick_pool()  With cpu_possible_mask=0-63 and cpu_online_mask=0-7 the following kernel oops was observed:  smp: Bringing up secondary CPUs ... smp: Brought up 1 node, 8 CPUs Unable to handle kernel pointer dereference in virtual kernel address space Failing address: 0000000000000000 TEID: 0000000000000803 [..]  Call Trace: arch_vcpu_is_preempted\u002B0x12/0x80 select_idle_sibling\u002B0x42/0x560 select_task_rq_fair\u002B0x29a/0x3b0 try_to_wake_up\u002B0x38e/0x6e0 kick_pool\u002B0xa4/0x198 __queue_work.part.0\u002B0x2bc/0x3a8 call_timer_fn\u002B0x36/0x160 __run_timers\u002B0x1e2/0x328 __run_timer_base\u002B0x5a/0x88 run_timer_softirq\u002B0x40/0x78 __do_softirq\u002B0x118/0x388 irq_exit_rcu\u002B0xc0/0xd8 do_ext_irq\u002B0xae/0x168 ext_int_handler\u002B0xbe/0xf0 psw_idle_exit\u002B0x0/0xc default_idle_call\u002B0x3c/0x110 do_idle\u002B0xd4/0x158 cpu_startup_entry\u002B0x40/0x48 rest_init\u002B0xc6/0xc8 start_kernel\u002B0x3c4/0x5e0 startup_continue\u002B0x3c/0x50  The crash is caused by calling arch_vcpu_is_preempted() for an offline CPU. To avoid this, select the cpu with cpumask_any_and_distribute() to mask __pod_cpumask with cpu_online_mask. In case no cpu is left in the pool, skip the assignment.  tj: This doesn\u0027t fully fix the bug as CPUs can still go down between picking the target CPU and the wake call. Fixing that likely requires adding cpu_online() test to either the sched or s390 arch code. However, regardless of how that is fixed, workqueue shouldn\u0027t be picking a CPU which isn\u0027t online as that would result in unpredictable and worse behavior.",
  "published": "2024-05-30T16:15:12Z",
  "severity": "medium",
  "cvss": 6.2,
  "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
  "epss": 0.00237,
  "epssPercentile": 0.14828,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "6.8.11-1",
      "fix": "DEBIAN-CVE-2024-36888",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2024-36888",
      "released": "2024-05-30T16:15:12Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "6.8.11-1",
      "fix": "DEBIAN-CVE-2024-36888",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2024-36888",
      "released": "2024-05-30T16:15:12Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-09T01:18:40Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}