{"cve":"CVE-2024-49856","nvd":{"published":"2024-10-21T13:15:06.353","modified":"2026-06-17T08:00:35.630","status":"Modified","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nx86/sgx: Fix deadlock in SGX NUMA node search\n\nWhen the current node doesn't have an EPC section configured by firmware\nand all other EPC sections are used up, CPU can get stuck inside the\nwhile loop that looks for an available EPC page from remote nodes\nindefinitely, leading to a soft lockup. Note how nid_of_current will\nnever be equal to nid in that while loop because nid_of_current is not\nset in sgx_numa_mask.\n\nAlso worth mentioning is that it's perfectly fine for the firmware not\nto setup an EPC section on a node. While setting up an EPC section on\neach node can enhance performance, it is not a requirement for\nfunctionality.\n\nRework the loop to start and end on *a* node that has SGX memory. This\navoids the deadlock looking for the current SGX-lacking node to show up\nin the loop when it never will.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","score":5.5},"cwes":["CWE-835"],"references":["https://git.kernel.org/stable/c/0f89fb4042c08fd143bfc28af08bf6c8a0197eea","https://git.kernel.org/stable/c/20c96d0aaabfe361fc2a11c173968dc67feadbbf","https://git.kernel.org/stable/c/40fb64257dab507d86b5f1f2a62f3669ef0c91a8","https://git.kernel.org/stable/c/8132510c915815e6b537ab937d94ed66893bc7b8","https://git.kernel.org/stable/c/9c936844010466535bd46ea4ce4656ef17653644"],"products":["linux:linux_kernel"],"source":"nvd","synced_at":"2026-10-19T21:56:33.105311382+00:00"},"epss":{"cve":"CVE-2024-49856","score":0.00207,"percentile":0.1081,"date":"2026-11-01"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}