high CVSS 7.1

CVE-2024-57838·Kernel vulnerability

In the Linux kernel, the following vulnerability has been resolved: s390/entry: Mark IRQ entries to fix stack depot warnings The stack depot filters out everything outside of the top interrupt context as an uninteresting or irrelevant part of the stack traces. This helps with stack trace de-duplication, avoiding an explosion of saved stack traces that share the same IRQ context code path but originate from different randomly interrupted points, eventually exhausting the stack depot. Filtering uses in_irqentry_text() to identify functions within the .irqentry.text and .softirqentry.text sections, which then become the last stack trace entries being saved. While __do_softirq() is placed into the .softirqentry.text section by common code, populating .irqentry.text is architecture-specific. Currently, the .irqentry.text section on s390 is empty, which prevents stack depot filtering and de-duplication and could result in warnings like: Stack depot reached limit capacity WARNING: CPU: 0 PID: 286113 at lib/stackdepot.c:252 depot_alloc_stack+0x39a/0x3c8 with PREEMPT and KASAN enabled. Fix this by moving the IO/EXT interrupt handlers from .kprobes.text into the .irqentry.text section and updating the kprobes blacklist to include the .irqentry.text section. This is done only for asynchronous interrupts and explicitly not for program checks, which are synchronous and where the context beyond the program check is important to preserve. Despite machine checks being somewhat in between, they are extremely rare, and preserving context when possible is also of value. SVCs and Restart Interrupts are not relevant, one being always at the boundary to user space and the other being a one-time thing. IRQ entries filtering is also optionally used in ftrace function graph, where the same logic applies.

Severity
high
Software
Kernel
Fixed in
6.12.4
Published
2025-01-11

Affected versions

From: 6.7

Until: 6.12.4

Fixed in: 6.12.4

How to fix this CVE

Update your Linux kernel to version 6.12.4 or later to resolve this stack depot exhaustion issue on s390 architecture. The vulnerability causes memory warnings and potential denial of service conditions when stack trace filtering fails due to missing IRQ entry markers. Apply the kernel update through your distribution's package manager and reboot the system to activate the fix.

sudo dnf update kernel kernel-headers && sudo reboot

Defensia detects this vulnerability

How to check if you are affected

  1. Check installed kernel version: uname -r (should be 6.12.4 or later for s390 systems)
  2. Verify vulnerability exposure on s390 architecture: uname -m | grep s390 (if output shows s390, the system is potentially affected if kernel < 6.12.4)
  3. Search system logs for stack depot warnings: sudo grep -i 'Stack depot reached limit capacity' /var/log/kern.log /var/log/messages (indicates the vulnerability was triggered)
  4. Confirm the fix by checking if .irqentry.text section is populated: readelf -S /boot/vmlinuz-* 2>/dev/null | grep -i irqentry (should show .irqentry.text section on patched kernels)

FAQ

What is CVE-2024-57838?

CVE-2024-57838 is a kernel vulnerability on s390 systems where interrupt entry points were not properly marked in memory sections, preventing stack trace de-duplication and causing the stack depot to exhaust capacity and issue warnings.

Is CVE-2024-57838 being actively exploited?

No, CVE-2024-57838 is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog and there are no public exploits available. However, it can be triggered through normal system operations on vulnerable s390 systems with PREEMPT and KASAN enabled.

What versions of Kernel are affected by CVE-2024-57838?

Kernel versions 6.7 through 6.12.3 on s390 architecture are affected. Version 6.12.4 and later include the fix.

How do I check if my server is vulnerable to CVE-2024-57838?

Run 'uname -r' to check your kernel version and 'uname -m' to confirm s390 architecture. Systems running kernel versions 6.7 to 6.12.3 on s390 are vulnerable. Check system logs with 'sudo grep -i "Stack depot reached limit" /var/log/kern.log' for evidence of the issue.

Does Defensia detect CVE-2024-57838?

Yes — Defensia's CVE advisory scanner compares installed package versions against the NVD database. If the Linux kernel is installed on a monitored s390 server, CVE-2024-57838 will appear in your dashboard with remediation steps.

Related Kernel CVEs

CVE-2026-63994CVSS 9.8In the Linux kernel, the following vulnerability has been resolved: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() Sashiko found that iptunnel_pmtud_build_icmp() and iptunnel_pmtud_build_icmpv6() were caching ip_hdr() and ipv6_hdr() before an skb_cow() call which can reallocate skb->head. Fix this possible UAF by initializing the local variables after the skb_cow() call. Remove skb_reset_network_header() calls which were not needed.
CVE-2026-64025CVSS 9.8In the Linux kernel, the following vulnerability has been resolved: bpf, skmsg: fix verdict sk_data_ready racing with ktls rx sk_psock_strp_data_ready() already checks tls_sw_has_ctx_rx() and defers to psock->saved_data_ready when a TLS RX context is present, avoiding a conflict with the TLS strparser's ownership of the receive queue (commit e91de6afa81c, "bpf: Fix running sk_skb program types with ktls"). sk_psock_verdict_data_ready() has no equivalent guard. When a socket is inserted into a sockmap (BPF_SK_SKB_VERDICT) before TLS RX is configured, tls_sw_strparser_arm() saves sk_psock_verdict_data_ready as rx_ctx->saved_data_ready. On data arrival: tls_data_ready -> tls_strp_data_ready -> tls_rx_msg_ready -> saved_data_ready() = sk_psock_verdict_data_ready() -> tcp_read_skb() drains sk_receive_queue via __skb_unlink() without calling tcp_eat_skb(), so copied_seq is not advanced. tls_strp_msg_load() then finds tcp_inq() >= full_len (stale), calls tcp_recv_skb() on the now-empty queue, hits WARN_ON_ONCE(!first), and returns with rx_ctx->strp.anchor.frag_list pointing at a psock-owned (potentially freed) skb. tls_decrypt_sg() subsequently walks that frag_list: use-after-free. Apply the same fix as sk_psock_strp_data_ready(): if a TLS RX context is present, call psock->saved_data_ready (sock_def_readable) to wake recv() waiters and return immediately, leaving the receive queue untouched. TLS retains sole ownership of the queue and decrypts the record normally through tls_sw_recvmsg().
CVE-2026-100075CVSS 9.8In the Linux kernel, the following vulnerability has been resolved: RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters When srpt_alloc_rw_ctxs() fails partway through a multi-buffer indirect descriptor, the unwind path destroys RDMA contexts but leaves stale n_rw_ctx and n_rdma values (and a dangling rw_ctxs pointer). Later sq_wr_avail accounting in srpt_queue_response() or srpt_write_pending() can then subtract the wrong number of send queue credits. Reset the counters and clear rw_ctxs after freeing the heap allocation before returning an error.
CVE-2026-64000CVSS 9.8In the Linux kernel, the following vulnerability has been resolved: net: hsr: fix potential OOB access in supervision frame handling Ensure the entire TLV header is linearized before access by adding sizeof(struct hsr_sup_tlv) to the pskb_may_pull() calls. Without this, a truncated frame could cause an out-of-bounds access.
CVE-2026-64439CVSS 9.8In the Linux kernel, the following vulnerability has been resolved: crypto: krb5 - filter out async aead implementations at alloc krb5_aead_encrypt(), krb5_aead_decrypt() in rfc3961_simplified.c and rfc8009_encrypt(), rfc8009_decrypt() in rfc8009_aes2.c set a NULL completion callback and treat any negative return from crypto_aead_{encrypt,decrypt}() as terminal, falling through to kfree_sensitive(buffer). When the encrypt_name resolves to an async AEAD instance the request returns -EINPROGRESS, the buffer is freed while the backend's worker still holds a pointer, and the worker dereferences the freed slab on completion. KASAN report under UML+SLUB with a synthetic async aead backend bound to krb5->encrypt_name: BUG: KASAN: slab-use-after-free in t5_stub_complete+0x7d/0xc7 The helpers were written synchronously, so filter the async instances out at allocation time instead of plumbing crypto_wait_req() through every call site. Reachable via net/rxrpc/rxgk.c, fs/afs/cm_security.c and net/ceph/crypto.c on systems with an async AEAD provider bound to the krb5 enctype name.

References

Track CVEs across your fleet automatically

Defensia scans your Linux servers and tells you exactly which ones are running vulnerable versions — including CVE-2024-57838. Free for 1 server.

Get started free