VYPR
← All advisories
Medium severity5.5NVD Advisory· Published Sep 4, 2024· Updated May 12, 2026

CVE-2024-44948

CVE-2024-44948

Description

In the Linux kernel, the following vulnerability has been resolved:

x86/mtrr: Check if fixed MTRRs exist before saving them

MTRRs have an obsolete fixed variant for fine grained caching control of the 640K-1MB region that uses separate MSRs. This fixed variant has a separate capability bit in the MTRR capability MSR.

So far all x86 CPUs which support MTRR have this separate bit set, so it went unnoticed that mtrr_save_state() does not check the capability bit before accessing the fixed MTRR MSRs.

Though on a CPU that does not support the fixed MTRR capability this results in a #GP. The #GP itself is harmless because the RDMSR fault is handled gracefully, but results in a WARN_ON().

Add the missing capability check to prevent this.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Missing capability check in Linux kernel's MTRR code causes a harmless #GP and WARN_ON() when saving fixed MTRRs on CPUs without support.

Vulnerability

Overview

The vulnerability resides in the x86 MTRR (Memory Type Range Registers) subsystem of the Linux kernel. Fixed MTRRs are an obsolete variant for fine-grained caching control of the 640K-1MB region, using separate MSRs. The capability bit for fixed MTRRs is present in the MTRR capability MSR. The function mtrr_save_state() did not check this capability bit before accessing the fixed MTRR MSRs. On CPUs that do not support fixed MTRRs, this results in a general protection fault (#GP). The #GP is handled gracefully by the kernel's fault handler but triggers a WARN_ON() [1].

Exploitation

The attack surface is local, requiring the ability to trigger the mtrr_save_state() path, which occurs during CPU hotplug or suspend/resume operations. The prerequisite is a CPU that lacks fixed MTRR support, which is rare but possible. The #GP itself is harmless, but the WARN_ON() could be leveraged for denial of service if the kernel is configured to panic on warnings (e.g., panic_on_warn=1). No authentication is needed beyond local access [1].

Impact

An attacker with local access could potentially cause a system crash if the kernel is configured to panic on WARN_ON(). Otherwise, the impact is limited to a warning message in the kernel log. The vulnerability is rated Medium with a CVSS v3 score of 5.5, reflecting the limited but possible denial-of-service scenario [1].

Mitigation

The fix adds the missing capability check before accessing fixed MTRR MSRs. Patches have been applied to stable kernel trees [2][3][4]. The Siemens advisory [1] lists this CVE as affecting the SIMATIC S7-1500 TM MFP - GNU/Linux subsystem and recommends updating to a fixed kernel version.

References
  1. SSA-265688
  2. Making sure you're not a bot!
  3. Making sure you're not a bot!
  4. Making sure you're not a bot!

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

112

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

11

News mentions

0

No linked articles in our index yet.