# CVE-2024-53089: LoongArch: KVM: Mark hrtimer to expire in hard interrupt context

CVE-2024-53089 is fixed in linux on 1 platform, first by DEBIAN-CVE-2024-53089, released November 21, 2024. It is not reported as exploited. Patch Radar priority: Routine.

- Web page: https://patchblox.com/security/cve/CVE-2024-53089
- Priority: Routine
- CVSS: 5.5 (medium)
- EPSS: 0.0019
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Nov 21, 2024
- Vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-53089

## Description

In the Linux kernel, the following vulnerability has been resolved:  LoongArch: KVM: Mark hrtimer to expire in hard interrupt context  Like commit 2c0d278f3293f ("KVM: LAPIC: Mark hrtimer to expire in hard interrupt context") and commit 9090825fa9974 ("KVM: arm/arm64: Let the timer expire in hardirq context on RT"), On PREEMPT_RT enabled kernels unmarked hrtimers are moved into soft interrupt expiry mode by default. Then the timers are canceled from an preempt-notifier which is invoked with disabled preemption which is not allowed on PREEMPT_RT.  The timer callback is short so in could be invoked in hard-IRQ context. So let the timer expire on hard-IRQ context even on -RT.  This fix a "scheduling while atomic" bug for PREEMPT_RT enabled kernels:   BUG: scheduling while atomic: qemu-system-loo/1011/0x00000002  Modules linked in: amdgpu rfkill nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct nft_chain_nat ns  CPU: 1 UID: 0 PID: 1011 Comm: qemu-system-loo Tainted: G        W          6.12.0-rc2+ #1774  Tainted: [W]=WARN  Hardware name: Loongson Loongson-3A5000-7A1000-1w-CRB/Loongson-LS3A5000-7A1000-1w-CRB, BIOS vUDK2018-LoongArch-V2.0.0-prebeta9 10/21/2022  Stack : ffffffffffffffff 0000000000000000 9000000004e3ea38 9000000116744000          90000001167475a0 0000000000000000 90000001167475a8 9000000005644830          90000000058dc000 90000000058dbff8 9000000116747420 0000000000000001          0000000000000001 6a613fc938313980 000000000790c000 90000001001c1140          00000000000003fe 0000000000000001 000000000000000d 0000000000000003          0000000000000030 00000000000003f3 000000000790c000 9000000116747830          90000000057ef000 0000000000000000 9000000005644830 0000000000000004          0000000000000000 90000000057f4b58 0000000000000001 9000000116747868          900000000451b600 9000000005644830 9000000003a13998 0000000010000020          00000000000000b0 0000000000000004 0000000000000000 0000000000071c1d          ...  Call Trace:  [<9000000003a13998>] show_stack+0x38/0x180  [<9000000004e3ea34>] dump_stack_lvl+0x84/0xc0  [<9000000003a71708>] __schedule_bug+0x48/0x60  [<9000000004e45734>] __schedule+0x1114/0x1660  [<9000000004e46040>] schedule_rtlock+0x20/0x60  [<9000000004e4e330>] rtlock_slowlock_locked+0x3f0/0x10a0  [<9000000004e4f038>] rt_spin_lock+0x58/0x80  [<9000000003b02d68>] hrtimer_cancel_wait_running+0x68/0xc0  [<9000000003b02e30>] hrtimer_cancel+0x70/0x80  [<ffff80000235eb70>] kvm_restore_timer+0x50/0x1a0 [kvm]  [<ffff8000023616c8>] kvm_arch_vcpu_load+0x68/0x2a0 [kvm]  [<ffff80000234c2d4>] kvm_sched_in+0x34/0x60 [kvm]  [<9000000003a749a0>] finish_task_switch.isra.0+0x140/0x2e0  [<9000000004e44a70>] __schedule+0x450/0x1660  [<9000000004e45cb0>] schedule+0x30/0x180  [<ffff800002354c70>] kvm_vcpu_block+0x70/0x120 [kvm]  [<ffff800002354d80>] kvm_vcpu_halt+0x60/0x3e0 [kvm]  [<ffff80000235b194>] kvm_handle_gspr+0x3f4/0x4e0 [kvm]  [<ffff80000235f548>] kvm_handle_exit+0x1c8/0x260 [kvm]

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | linux Debian 13.5 (trixie) | 6.11.9-1 | [DEBIAN-CVE-2024-53089](https://patchblox.com/security/data/fix/linux/debian-cve-2024-53089.md) | Nov 21, 2024 |
| Linux | linux Debian 14 | 6.11.9-1 | [DEBIAN-CVE-2024-53089](https://patchblox.com/security/data/fix/linux/debian-cve-2024-53089.md) | Nov 21, 2024 |

---

Data as of 2026-11-12T01:51:14Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.