{"id":"DEBIAN-CVE-2024-44981","details":"In the Linux kernel, the following vulnerability has been resolved:  workqueue: Fix UBSAN 'subtraction overflow' error in shift_and_mask()  UBSAN reports the following 'subtraction overflow' error when booting in a virtual machine on Android:   | Internal error: UBSAN: integer subtraction overflow: 00000000f2005515 [#1] PREEMPT SMP  | Modules linked in:  | CPU: 0 PID: 1 Comm: swapper/0 Not tainted 6.10.0-00006-g3cbe9e5abd46-dirty #4  | Hardware name: linux,dummy-virt (DT)  | pstate: 600000c5 (nZCv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--)  | pc : cancel_delayed_work+0x34/0x44  | lr : cancel_delayed_work+0x2c/0x44  | sp : ffff80008002ba60  | x29: ffff80008002ba60 x28: 0000000000000000 x27: 0000000000000000  | x26: 0000000000000000 x25: 0000000000000000 x24: 0000000000000000  | x23: 0000000000000000 x22: 0000000000000000 x21: ffff1f65014cd3c0  | x20: ffffc0e84c9d0da0 x19: ffffc0e84cab3558 x18: ffff800080009058  | x17: 00000000247ee1f8 x16: 00000000247ee1f8 x15: 00000000bdcb279d  | x14: 0000000000000001 x13: 0000000000000075 x12: 00000a0000000000  | x11: ffff1f6501499018 x10: 00984901651fffff x9 : ffff5e7cc35af000  | x8 : 0000000000000001 x7 : 3d4d455453595342 x6 : 000000004e514553  | x5 : ffff1f6501499265 x4 : ffff1f650ff60b10 x3 : 0000000000000620  | x2 : ffff80008002ba78 x1 : 0000000000000000 x0 : 0000000000000000  | Call trace:  |  cancel_delayed_work+0x34/0x44  |  deferred_probe_extend_timeout+0x20/0x70  |  driver_register+0xa8/0x110  |  __platform_driver_register+0x28/0x3c  |  syscon_init+0x24/0x38  |  do_one_initcall+0xe4/0x338  |  do_initcall_level+0xac/0x178  |  do_initcalls+0x5c/0xa0  |  do_basic_setup+0x20/0x30  |  kernel_init_freeable+0x8c/0xf8  |  kernel_init+0x28/0x1b4  |  ret_from_fork+0x10/0x20  | Code: f9000fbf 97fffa2f 39400268 37100048 (d42aa2a0)  | ---[ end trace 0000000000000000 ]---  | Kernel panic - not syncing: UBSAN: integer subtraction overflow: Fatal exception  This is due to shift_and_mask() using a signed immediate to construct the mask and being called with a shift of 31 (WORK_OFFQ_POOL_SHIFT) so that it ends up decrementing from INT_MIN.  Use an unsigned constant '1U' to generate the mask in shift_and_mask().","modified":"2026-09-15T09:03:11.129148578Z","published":"2024-09-04T20:15:07.533Z","upstream":["CVE-2024-44981"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2024-44981"}],"affected":[{"package":{"name":"linux","ecosystem":"Debian:13","purl":"pkg:deb/debian/linux?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.10.7-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2024-44981.json"}},{"package":{"name":"linux","ecosystem":"Debian:14","purl":"pkg:deb/debian/linux?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.10.7-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2024-44981.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}]}