CVE-2024-56764
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2024-56764
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-56764.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2024-56764
- Downstream
- Related
- Published
- 2025-01-06T16:20:43Z
- Modified
- 2025-10-10T04:03:38.415733Z
- Severity
-
- 7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- ublk: detach gendisk from ublk device if add_disk() fails
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
ublk: detach gendisk from ublk device if add_disk() fails
Inside ublkabortrequests(), gendisk is grabbed for aborting all inflight requests. And ublkabortrequests() is called when exiting the uring context or handling timeout.
If adddisk() fails, the gendisk may have been freed when calling ublkabortrequests(), so use-after-free can be caused when getting disk's reference in ublkabort_requests().
Fixes the bug by detaching gendisk from ublk device if add_disk() fails.
- References
Affected packages
Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected ranges
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introducedbd23f6c2c2d00518e2f27f2d25cef795de9bee56Fixed7d680f2f76a3417fdfc3946da7471e81464f7b41
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introducedbd23f6c2c2d00518e2f27f2d25cef795de9bee56Fixed75cd4005da5492129917a4a4ee45e81660556104
Affected versions
v6.*
v6.10
v6.10-rc1
v6.10-rc2
v6.10-rc3
v6.10-rc4
v6.10-rc5
v6.10-rc6
v6.10-rc7
v6.11
v6.11-rc1
v6.11-rc2
v6.11-rc3
v6.11-rc4
v6.11-rc5
v6.11-rc6
v6.11-rc7
v6.12
v6.12-rc1
v6.12-rc2
v6.12-rc3
v6.12-rc4
v6.12-rc5
v6.12-rc6
v6.12-rc7
v6.12.1
v6.12.2
v6.12.3
v6.12.4
v6.12.5
v6.12.6
v6.12.7
v6.13-rc1
v6.6
v6.6-rc3
v6.6-rc4
v6.6-rc5
v6.6-rc6
v6.6-rc7
v6.7
v6.7-rc1
v6.7-rc2
v6.7-rc3
v6.7-rc4
v6.7-rc5
v6.7-rc6
v6.7-rc7
v6.7-rc8
v6.8
v6.8-rc1
v6.8-rc2
v6.8-rc3
v6.8-rc4
v6.8-rc5
v6.8-rc6
v6.8-rc7
v6.9
v6.9-rc1
v6.9-rc2
v6.9-rc3
v6.9-rc4
v6.9-rc5
v6.9-rc6
v6.9-rc7