Security readout for executives and security teams
Plain-English summary
This Linux kernel issue can deadlock during early clock and power-management handling, leaving tasks hung and potentially preventing normal boot or device initialization. It is a reliability and availability concern, especially for systems using affected kernel builds and hardware drivers that exercise runtime power management.
Executive priority
Prioritize remediation in Linux-based appliances, embedded systems, and production hosts where boot or device initialization hangs would affect service availability. This is not currently evidenced as exploited, but kernel deadlocks can still create operational outages.
Technical view
The flaw is an ABBA deadlock between the global clock prepare_lock and runtime PM resume paths during clk_disable_unused tree walking. One path holds prepare_lock while resuming a device; another runtime-resume callback tries to prepare clocks and waits on the same lock.
Likely exposure
Exposure is likely limited to Linux systems running affected kernel versions or vendor builds with the vulnerable clock framework behavior. Embedded, appliance, and hardware-specific deployments should check distro and device-vendor advisories because kernel fixes may be backported under different version numbers.
Exploitation context
The provided sources describe hung tasks and a resolved kernel deadlock, not a remote attack path. KEV is false, and no cited source claims active exploitation. Treat this as an availability risk unless your vendor documents a stronger impact.
Researcher notes
The key evidence is the kernel commit rationale: clk_disable_unused can call runtime PM while holding prepare_lock, while a resume callback can call clk_prepare and wait on prepare_lock. The fix direction is to avoid that immediate deadlock condition in stable kernels.
Mitigation direction
- Update affected Linux kernels to vendor-supported builds containing the referenced stable fixes.
- Review Debian LTS, Fedora, Siemens, and other applicable vendor advisories for packaged updates.
- For appliances, confirm firmware includes the Linux kernel fix or vendor-approved mitigation.
- Avoid relying on undocumented local workarounds; follow kernel or product-vendor guidance.
Validation and detection
- Inventory Linux kernel versions and vendor firmware against the CVE and advisory references.
- Check whether your distribution has backported one of the listed stable kernel commits.
- Review boot and runtime PM logs for repeated hung-task reports in clock or device resume paths.
- Confirm patched test systems complete boot and device initialization without the reported deadlock symptoms.
Public sources used
- CVE Program
- CVE List V5
- Linux stable commit 253ab38d1ee6
- Linux stable commit 4af115f1a20a
- Linux stable commit a29ec0465dce
- Linux stable commit a424e713e0cc
- Linux stable commit 60ff482c4205
- Linux stable commit 115554862294
- Linux stable commit e581cf5d2162
- Debian LTS advisory
- Fedora package advisory DAMSOZX
- Siemens ProductCERT advisory SSA-265688
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2024-27004 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/253ab38d1ee652a596942156978a233970d185baCVE reference, Linux
- https://git.kernel.org/stable/c/4af115f1a20a3d9093586079206ee37c2ac55123CVE reference, Linux
- https://git.kernel.org/stable/c/a29ec0465dce0b871003698698ac6fa92c9a5034CVE reference, Linux
- https://git.kernel.org/stable/c/a424e713e0cc33d4b969cfda25b9f46df4d7b5bcCVE reference, Linux
- https://git.kernel.org/stable/c/60ff482c4205a5aac3b0595ab794cfd62295dab5CVE reference, Linux
- https://git.kernel.org/stable/c/115554862294397590088ba02f11f2aba6d5016cCVE reference, Linux
- https://git.kernel.org/stable/c/e581cf5d216289ef292d1a4036d53ce90e122469CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2024/06/msg00017.htmlCVE reference, CVE · x_transferred
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DAMSOZXJEPUOXW33WZYWCVAY7Z5S7OOY/CVE reference, CVE
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4EZ6PJW7VOZ224TD7N4JZNU6KV32ZJ53/CVE reference, CVE
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GCBZZEC7L7KTWWAS2NLJK6SO3IZIL4WW/CVE reference, CVE
- https://cert-portal.siemens.com/productcert/html/ssa-265688.htmlCVE reference, siemens-SADP
- https://cert-portal.siemens.com/productcert/html/ssa-613116.htmlCVE reference, siemens-SADP
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.