CVE-2024-57951: hrtimers: Handle CPU state correctly on hotplug

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• linux linux kernel4.19.302 and later · before 4.20
• linux linux kernel5.4.264 and later · before 5.4.290
• linux linux kernel5.10.204 and later · before 5.10.234
• linux linux kernel5.15.143 and later · before 5.15.177
• linux linux kernel6.1.68 and later · before 6.1.127
• linux linux kernel6.6.7 and later · before 6.6.74
• linux linux kernel6.7 and later · before 6.12.11
• linux linux kernel6.13

Versions reported by the vendor

Affected version ranges reported by the assigning authority (Linux). Independent of NVD's CPE analysis and usually ahead of it.

• Linux Linux

  • 9a2fc41acb69dd4e2a58d0c04346c3333c2341fc, 6.7affected
  • 54d0d83a53508d687fd4a225f8aa1f18559562d0 and later · before 95e4f62df23f4df1ce6ef897d44b8e23c260921aaffected · git
  • 7f4c89400d2997939f6971c7981cc780a219e36b and later · before 14984139f1f2768883332965db566ef26db609e7affected · git
  • 6fcbcc6c8e52650749692c7613cbe71bf601670d and later · before 15b453db41d36184cf0ccc21e7df624014ab6a1aaffected · git
  • 75b5016ce325f1ef9c63e5398a1064cf8a7a7354 and later · before 3d41dbf82e10c44e53ea602398ab002baec27e75affected · git
  • 53f408cad05bb987af860af22f4151e5a18e6ee8 and later · before a5cbbea145b400e40540c34816d16d36e0374fbcaffected · git
  • 5c0930ccaad5a74d74e8b18b648c5eb21ed2fe94 and later · before 38492f6ee883c7b1d33338bf531a62cff69b4b28affected · git
  • 5c0930ccaad5a74d74e8b18b648c5eb21ed2fe94 and later · before 2f8dea1692eef2b7ba6a256246ed82c365fdc686affected · git
  • 5.4.264 and later · before 5.4.290affected · semver
  • 5.10.204 and later · before 5.10.234affected · semver

Package-level exposure

OSV and GitHub Advisory data: ecosystem, package and range. SBOM matching uses this table.

Other highest-scoring records for the same primary product.

• CVE-2026-31431crypto: algif_aead - Revert to operating out-of-placeKEV
  90Now
• CVE-2022-0847A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in copy_page_to_iter_pipe KEV
  89Now
• CVE-2021-22555Heap Out-Of-Bounds Write in Netfilter IP6T_SO_SET_REPLACEKEV
  85Now

Published before and after this one in the same product

• ← EarlierCVE-2025-21697Feb 12, 2025 · drm/v3d: Ensure job pointer is set to NULL after job completion
  22Monitor
• ← EarlierCVE-2025-21699Feb 12, 2025 · gfs2: Truncate address space when flipping GFS2_DIF_JDATA flag
  22Monitor
• Later →CVE-2025-21694Feb 12, 2025 · fs/proc: fix softlockup in __read_vmcore (part 2)
  22Monitor

Root cause

After a memory region is freed, another reference pointing to it is still used. By then, the same region may have been allocated for different data.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1free(dev->buf);2/* ... another thread is still running ... */3process(dev->buf);

1lock(&dev->lock);2free(dev->buf);3dev->buf = NULL;4unlock(&dev->lock);

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.

MITRE has no CAPEC/ATT&CK mapping for this CWE.