LiveActive security incident?Get immediate response
CVE Record

CVE-2024-56690: crypto: pcrypt - Call crypto layer directly when padata_do_parallel() return -EBUSY

In the Linux kernel, the following vulnerability has been resolved: crypto: pcrypt - Call crypto layer directly when padata_do_parallel() return -EBUSY Since commit 8f4f68e788c3 ("crypto: pcrypt - Fix hungtask for PADATA_RESET"), the pcrypt encryption and decryption operations return -EAGAIN when the CPU goes online or offline. In alg_test(), a WARN is generated when pcrypt_aead_decrypt() or pcrypt_aead_encrypt() returns -EAGAIN, the unnecessary panic will occur when panic_on_warn set 1. Fix this issue by calling crypto layer directly without parallelization in that case.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

This Linux kernel issue can turn a crypto self-test warning into a system panic when `panic_on_warn=1` is enabled. The described impact is availability, not data theft. Business urgency depends on kernel exposure, use of the pcrypt crypto path, CPU hotplug activity, and whether warning panics are enabled.

Executive priority

Treat this as a targeted availability risk. It is not supported as actively exploited, but affected production kernels can panic under specific conditions. Patch through the normal kernel maintenance process, with priority for high-availability systems and hosts configured to panic on warnings.

Technical view

In pcrypt, encryption or decryption may return `-EAGAIN` when CPU online or offline events make `padata_do_parallel()` return busy. `alg_test()` can WARN on that return, and systems with `panic_on_warn=1` may panic. The fix calls the crypto layer directly without parallelization in that case.

Likely exposure

Exposure is limited to Linux kernels covered by the CVE record and vendor backports. The bundle lists multiple affected stable branches and commit references, but exact package status should be confirmed against each distribution’s kernel advisory and installed kernel version.

Exploitation context

The source bundle does not support active exploitation: KEV is false and no exploit report is cited. The described trigger is a kernel crypto and CPU hotplug error path that can cause a warning-induced panic under specific configuration.

Researcher notes

Focus validation on the pcrypt AEAD path, `padata_do_parallel()` busy handling, CPU hotplug timing, and `alg_test()` WARN behavior. The bundle provides stable kernel commits and Debian LTS advisories, but no CVSS, CWE, proof-of-concept, or broad exploitation evidence.

Mitigation direction

  • Update Linux kernels using vendor packages that include the referenced stable fixes.
  • Track Debian LTS advisories if using Debian-based long-term-support systems.
  • Review whether `panic_on_warn=1` is intentionally required on exposed production hosts.
  • Prioritize systems using CPU hotplug, virtualization, or pcrypt-dependent crypto workloads.

Validation and detection

  • Inventory running kernel versions across Linux hosts and appliances.
  • Compare installed kernels with the CVE record and distribution advisories.
  • Check boot parameters and sysctl state for `panic_on_warn` behavior.
  • Review kernel logs for pcrypt, padata, crypto self-test, or WARN events.
Prepared
Confidence
medium
Sources
12

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2024-56690 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
1ADP providers
12Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CVECVE Program Container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux039fec48e062504f14845124a1a25eb199b2ddc0, c9c1334697301c10e6918d747ed38abfbc0c96e7, e97bf4ada7dddacd184c3e196bd063b0dc71b41d, 546c1796ad1ed0d87dab3c4b5156d75819be2316, c55fc098fd9d2dca475b82d00ffbcaf97879d77e, 372636debe852913529b1716f44addd94fff2d28, 8f4f68e788c3a7a696546291258bfa5fdb215523, 8f4f68e788c3a7a696546291258bfa5fdb215523, 8f4f68e788c3a7a696546291258bfa5fdb215523, fb2d3a50a8f29a3c66682bb426144f40e32ab818, e134f3aba98e6c801a693f540912c2d493718ddf, 4.19.300, 5.4.262, 5.10.202, 5.15.140, 6.1.64, 6.6.3, 4.14.331, 6.5.13unaffected
LinuxLinux6.7, 0, 4.19.325, 5.4.287, 5.10.231, 5.15.174, 6.1.120, 6.6.64, 6.11.11, 6.12.2, 6.13affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.