{"id":"DEBIAN-CVE-2024-57917","details":"In the Linux kernel, the following vulnerability has been resolved:  topology: Keep the cpumask unchanged when printing cpumap  During fuzz testing, the following warning was discovered:   different return values (15 and 11) from vsnprintf(\"%*pbl  \", ...)   test:keyward is WARNING in kvasprintf  WARNING: CPU: 55 PID: 1168477 at lib/kasprintf.c:30 kvasprintf+0x121/0x130  Call Trace:   kvasprintf+0x121/0x130   kasprintf+0xa6/0xe0   bitmap_print_to_buf+0x89/0x100   core_siblings_list_read+0x7e/0xb0   kernfs_file_read_iter+0x15b/0x270   new_sync_read+0x153/0x260   vfs_read+0x215/0x290   ksys_read+0xb9/0x160   do_syscall_64+0x56/0x100   entry_SYSCALL_64_after_hwframe+0x78/0xe2  The call trace shows that kvasprintf() reported this warning during the printing of core_siblings_list. kvasprintf() has several steps:   (1) First, calculate the length of the resulting formatted string.   (2) Allocate a buffer based on the returned length.   (3) Then, perform the actual string formatting.   (4) Check whether the lengths of the formatted strings returned in      steps (1) and (2) are consistent.  If the core_cpumask is modified between steps (1) and (3), the lengths obtained in these two steps may not match. Indeed our test includes cpu hotplugging, which should modify core_cpumask while printing.  To fix this issue, cache the cpumask into a temporary variable before calling cpumap_print_{list, cpumask}_to_buf(), to keep it unchanged during the printing process.","modified":"2026-09-15T09:03:00.143300318Z","published":"2025-01-19T12:15:25.860Z","upstream":["CVE-2024-57917"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2024-57917"}],"affected":[{"package":{"name":"linux","ecosystem":"Debian:12","purl":"pkg:deb/debian/linux?arch=source&distro=bookworm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.128-1"}]}],"versions":["6.1.106-1","6.1.106-2","6.1.106-3","6.1.112-1","6.1.115-1","6.1.119-1","6.1.123-1","6.1.124-1","6.1.27-1","6.1.37-1","6.1.38-1","6.1.38-2","6.1.38-2~bpo11+1","6.1.38-3","6.1.38-4","6.1.38-4~bpo11+1","6.1.52-1","6.1.55-1","6.1.55-1~bpo11+1","6.1.64-1","6.1.66-1","6.1.67-1","6.1.69-1","6.1.69-1~bpo11+1","6.1.76-1","6.1.76-1~bpo11+1","6.1.82-1","6.1.85-1","6.1.90-1","6.1.90-1~bpo11+1","6.1.94-1","6.1.94-1~bpo11+1","6.1.98-1","6.1.99-1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2024-57917.json"}},{"package":{"name":"linux","ecosystem":"Debian:13","purl":"pkg:deb/debian/linux?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.10-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2024-57917.json"}},{"package":{"name":"linux","ecosystem":"Debian:14","purl":"pkg:deb/debian/linux?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.10-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2024-57917.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}