What’s Vulnerable › Vulnerabilities

CVE-2024-38614: openrisc: traps: Don't send signals to kernel mode threads

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-06-19 · updated 2026-08-04

Description

In the Linux kernel, the following vulnerability has been resolved: openrisc: traps: Don't send signals to kernel mode threads OpenRISC exception handling sends signals to user processes on floating point exceptions and trap instructions (for debugging) among others. There is a bug where the trap handling logic may send signals to kernel threads, we should not send these signals to kernel threads, if that happens we treat it as an error. This patch adds conditions to die if the kernel receives these exceptions in kernel mode code.

Affected products

• Linux kernel: from 6.4 before 6.6.33; from 6.7 before 6.8.12; from 6.9 before 6.9.3 — fixed in 6.6.33, 6.8.12, 6.9.3

How to fix

Upgrade to a fixed version: Linux kernel 6.6.33, 6.8.12, 6.9.3. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/075c0405b0d7d9fc490609e988a3af0069596538
• https://git.kernel.org/stable/c/c0ed9a711e3392d73e857faa031d8d349c0d70db
• https://git.kernel.org/stable/c/c88cfb5cea5f8f9868ef02cc9ce9183a26dcf20f
• https://git.kernel.org/stable/c/cea9d0015c140af39477dd5eeb9b20233a45daa9
• https://git.kernel.org/stable/c/075c0405b0d7d9fc490609e988a3af0069596538
• https://git.kernel.org/stable/c/c0ed9a711e3392d73e857faa031d8d349c0d70db
• https://git.kernel.org/stable/c/c88cfb5cea5f8f9868ef02cc9ce9183a26dcf20f
• https://git.kernel.org/stable/c/cea9d0015c140af39477dd5eeb9b20233a45daa9

Get alerted when CVE-2024-38614 or the next vulnerability affects your stack