CVE-2024-40922

Source
https://nvd.nist.gov/vuln/detail/CVE-2024-40922
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-40922.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2024-40922
Downstream
Related
Published
2024-07-12T12:25:03Z
Modified
2025-10-17T03:19:24.799687Z
Summary
io_uring/rsrc: don't lock while !TASK_RUNNING
Details

In the Linux kernel, the following vulnerability has been resolved:

iouring/rsrc: don't lock while !TASKRUNNING

There is a report of iorsrcrefquiesce() locking a mutex while not TASKRUNNING, which is due to forgetting restoring the state back after ioruntaskworksig() and attempts to break out of the waiting loop.

do not call blocking ops when !TASKRUNNING; state=1 set at [<ffffffff815d2494>] preparetowait+0xa4/0x380 kernel/sched/wait.c:237 WARNING: CPU: 2 PID: 397056 at kernel/sched/core.c:10099 mightsleep+0x114/0x160 kernel/sched/core.c:10099 RIP: 0010:mightsleep+0x114/0x160 kernel/sched/core.c:10099 Call Trace: <TASK> _mutexlockcommon kernel/locking/mutex.c:585 [inline] _mutexlock+0xb4/0x940 kernel/locking/mutex.c:752 iorsrcrefquiesce+0x590/0x940 iouring/rsrc.c:253 iosqebuffersunregister+0xa2/0x340 iouring/rsrc.c:799 _iouringregister iouring/register.c:424 [inline] _dosysiouringregister+0x5b9/0x2400 iouring/register.c:613 dosyscallx64 arch/x86/entry/common.c:52 [inline] dosyscall64+0xd8/0x270 arch/x86/entry/common.c:83 entrySYSCALL64afterhwframe+0x6f/0x77

References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
4ea15b56f0810f0d8795d475db1bb74b3a7c1b2f
Fixed
0c9df3df0c888d9ec8d11a68474a4aa04d371cff
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
4ea15b56f0810f0d8795d475db1bb74b3a7c1b2f
Fixed
4429c6c77e176a4c5aa7a3bbd1632f9fc0582518
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
4ea15b56f0810f0d8795d475db1bb74b3a7c1b2f
Fixed
54559642b96116b45e4b5ca7fd9f7835b8561272

Affected versions

v6.*

v6.10-rc1
v6.3
v6.3-rc6
v6.3-rc7
v6.4
v6.4-rc1
v6.4-rc2
v6.4-rc3
v6.4-rc4
v6.4-rc5
v6.4-rc6
v6.4-rc7
v6.5
v6.5-rc1
v6.5-rc2
v6.5-rc3
v6.5-rc4
v6.5-rc5
v6.5-rc6
v6.5-rc7
v6.6
v6.6-rc1
v6.6-rc2
v6.6-rc3
v6.6-rc4
v6.6-rc5
v6.6-rc6
v6.6-rc7
v6.6.1
v6.6.10
v6.6.11
v6.6.12
v6.6.13
v6.6.14
v6.6.15
v6.6.16
v6.6.17
v6.6.18
v6.6.19
v6.6.2
v6.6.20
v6.6.21
v6.6.22
v6.6.23
v6.6.24
v6.6.25
v6.6.26
v6.6.27
v6.6.28
v6.6.29
v6.6.3
v6.6.30
v6.6.31
v6.6.32
v6.6.33
v6.6.34
v6.6.4
v6.6.5
v6.6.6
v6.6.7
v6.6.8
v6.6.9
v6.7
v6.7-rc1
v6.7-rc2
v6.7-rc3
v6.7-rc4
v6.7-rc5
v6.7-rc6
v6.7-rc7
v6.7-rc8
v6.8
v6.8-rc1
v6.8-rc2
v6.8-rc3
v6.8-rc4
v6.8-rc5
v6.8-rc6
v6.8-rc7
v6.9
v6.9-rc1
v6.9-rc2
v6.9-rc3
v6.9-rc4
v6.9-rc5
v6.9-rc6
v6.9-rc7
v6.9.1
v6.9.2
v6.9.3
v6.9.4
v6.9.5

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
6.4.0
Fixed
6.6.35
Type
ECOSYSTEM
Events
Introduced
6.7.0
Fixed
6.9.6