LiveActive security incident?Get immediate response
CVE Record

CVE-2024-42126: powerpc: Avoid nmi_enter/nmi_exit in real mode interrupt.

In the Linux kernel, the following vulnerability has been resolved: powerpc: Avoid nmi_enter/nmi_exit in real mode interrupt. nmi_enter()/nmi_exit() touches per cpu variables which can lead to kernel crash when invoked during real mode interrupt handling (e.g. early HMI/MCE interrupt handler) if percpu allocation comes from vmalloc area. Early HMI/MCE handlers are called through DEFINE_INTERRUPT_HANDLER_NMI() wrapper which invokes nmi_enter/nmi_exit calls. We don't see any issue when percpu allocation is from the embedded first chunk. However with CONFIG_NEED_PER_CPU_PAGE_FIRST_CHUNK enabled there are chances where percpu allocation can come from the vmalloc area. With kernel command line "percpu_alloc=page" we can force percpu allocation to come from vmalloc area and can see kernel crash in machine_check_early: [ 1.215714] NIP [c000000000e49eb4] rcu_nmi_enter+0x24/0x110 [ 1.215717] LR [c0000000000461a0] machine_check_early+0xf0/0x2c0 [ 1.215719] --- interrupt: 200 [ 1.215720] [c000000fffd73180] [0000000000000000] 0x0 (unreliable) [ 1.215722] [c000000fffd731b0] [0000000000000000] 0x0 [ 1.215724] [c000000fffd73210] [c000000000008364] machine_check_early_common+0x134/0x1f8 Fix this by avoiding use of nmi_enter()/nmi_exit() in real mode if percpu first chunk is not embedded.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2024-42126 is a Linux kernel bug affecting PowerPC interrupt handling. In specific early hardware-error interrupt paths, the kernel may touch per-CPU memory that is not safely accessible, causing a crash. The sources describe an availability risk, not data theft or remote code execution.

Executive priority

Treat as a targeted availability issue for PowerPC Linux estates. It should be patched through normal kernel maintenance, with higher urgency for critical PowerPC workloads where kernel crashes could disrupt operations.

Technical view

The flaw is in PowerPC real-mode HMI/MCE interrupt handling. NMI wrappers call nmi_enter/nmi_exit, which access per-CPU variables. When the per-CPU first chunk is page/vmalloc backed instead of embedded, this can crash in early machine_check handling. The fix avoids nmi_enter/nmi_exit in real mode when unsafe.

Likely exposure

Exposure is most likely on Linux PowerPC systems running affected kernel builds, especially configurations where per-CPU allocation can come from vmalloc, such as CONFIG_NEED_PER_CPU_PAGE_FIRST_CHUNK or forced page allocation. Non-PowerPC systems are not indicated by the provided sources.

Exploitation context

The source bundle provides a crash scenario and kernel fix references, but no evidence of active exploitation. CISA KEV status is false. The sources do not describe remote attack requirements, public exploit code, or privilege boundaries.

Researcher notes

Evidence is strongest for a deterministic crash condition in early HMI/MCE handling when per-CPU data is vmalloc backed. The bundle does not provide CVSS, CWE, exploitability analysis, or proof of remote triggerability, so exposure assessment depends on platform, kernel build, and configuration.

Mitigation direction

  • Upgrade to a vendor kernel containing the referenced stable fixes.
  • Check Debian or distribution advisories for patched kernel packages.
  • Prioritize PowerPC systems that require high availability.
  • Avoid custom per-CPU allocation settings unless required and supported.
  • If no package is available, track vendor guidance before changing kernels.

Validation and detection

  • Inventory PowerPC Linux systems and kernel versions.
  • Compare running kernels against vendor advisories and stable fix commits.
  • Check kernel configuration for per-CPU first-chunk allocation behavior.
  • Review boot parameters for forced page-backed per-CPU allocation.
  • Confirm patched systems boot cleanly after kernel update.
Prepared
Confidence
medium
Sources
9

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2024-42126 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
2ADP providers
8Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CVECVE Program Container
CISA-ADPCISA ADP Vulnrichment
other:ssvc

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxeb553f16973ade990d05946af9ae191394712c8a, eb553f16973ade990d05946af9ae191394712c8a, eb553f16973ade990d05946af9ae191394712c8a, eb553f16973ade990d05946af9ae191394712c8a, eb553f16973ade990d05946af9ae191394712c8a, eb553f16973ade990d05946af9ae191394712c8aunaffected
LinuxLinux5.10, 0, 5.10.224, 5.15.165, 6.1.98, 6.6.39, 6.9.9, 6.10affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.