CVE-2024-26671
Linux Kernel blk-mq Wait Queue Wake-up Race Vulnerability
Description
In the Linux kernel, the following vulnerability has been resolved: blk-mq: fix IO hang from sbitmap wakeup race In blk_mq_mark_tag_wait(), __add_wait_queue() may be re-ordered with the following blk_mq_get_driver_tag() in case of getting driver tag failure. Then in __sbitmap_queue_wake_up(), waitqueue_active() may not observe the added waiter in blk_mq_mark_tag_wait() and wake up nothing, meantime blk_mq_mark_tag_wait() can't get driver tag successfully. This issue can be reproduced by running the following test in loop, and fio hang can be observed in < 30min when running it on my test VM in laptop. modprobe -r scsi_debug modprobe scsi_debug delay=0 dev_size_mb=4096 max_queue=1 host_max_queue=1 submit_queues=4 dev=`ls -d /sys/bus/pseudo/drivers/scsi_debug/adapter*/host*/target*/*/block/* | head -1 | xargs basename` fio --filename=/dev/"$dev" --direct=1 --rw=randrw --bs=4k --iodepth=1 \ --runtime=100 --numjobs=40 --time_based --name=test \ --ioengine=libaio Fix the issue by adding one explicit barrier in blk_mq_mark_tag_wait(), which is just fine in case of running out of tag.
INFO
Published Date :
April 2, 2024, 7:15 a.m.
Last Modified :
March 17, 2025, 3:03 p.m.
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Remotely Exploitable :
No
Impact Score :
3.6
Exploitability Score :
1.0
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2024-26671.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2024-26671 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2024-26671 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
Initial Analysis by [email protected]
Mar. 17, 2025
Action Type Old Value New Value Added CVSS V3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H Added CWE CWE-362 Added CPE Configuration OR *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.11 from (excluding) 5.15.149 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.5 from (excluding) 5.10.210 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.16 from (excluding) 6.1.77 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 4.20 from (excluding) 5.4.269 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (excluding) 4.19.307 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.2 from (excluding) 6.7.4 Added CPE Configuration OR *cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Added Reference Type CVE: https://git.kernel.org/stable/c/1d9c777d3e70bdc57dddf7a14a80059d65919e56 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/1d9c777d3e70bdc57dddf7a14a80059d65919e56 Types: Patch Added Reference Type CVE: https://git.kernel.org/stable/c/5266caaf5660529e3da53004b8b7174cab6374ed Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/5266caaf5660529e3da53004b8b7174cab6374ed Types: Patch Added Reference Type CVE: https://git.kernel.org/stable/c/6d8b01624a2540336a32be91f25187a433af53a0 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/6d8b01624a2540336a32be91f25187a433af53a0 Types: Patch Added Reference Type CVE: https://git.kernel.org/stable/c/7610ba1319253225a9ba8a9d28d472fc883b4e2f Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/7610ba1319253225a9ba8a9d28d472fc883b4e2f Types: Patch Added Reference Type CVE: https://git.kernel.org/stable/c/89e0e66682e1538aeeaa3109503473663cd24c8b Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/89e0e66682e1538aeeaa3109503473663cd24c8b Types: Patch Added Reference Type CVE: https://git.kernel.org/stable/c/9525b38180e2753f0daa1a522b7767a2aa969676 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/9525b38180e2753f0daa1a522b7767a2aa969676 Types: Patch Added Reference Type CVE: https://git.kernel.org/stable/c/ecd7744a1446eb02ccc63e493e2eb6ede4ef1e10 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/ecd7744a1446eb02ccc63e493e2eb6ede4ef1e10 Types: Patch Added Reference Type CVE: https://git.kernel.org/stable/c/f1bc0d8163f8ee84a8d5affdf624cfad657df1d2 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/f1bc0d8163f8ee84a8d5affdf624cfad657df1d2 Types: Patch Added Reference Type CVE: https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html Types: Mailing List Added Reference Type CVE: https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html Types: Mailing List -
CVE Modified by af854a3a-2127-422b-91ae-364da2661108
Nov. 21, 2024
Action Type Old Value New Value Added Reference https://git.kernel.org/stable/c/1d9c777d3e70bdc57dddf7a14a80059d65919e56 Added Reference https://git.kernel.org/stable/c/5266caaf5660529e3da53004b8b7174cab6374ed Added Reference https://git.kernel.org/stable/c/6d8b01624a2540336a32be91f25187a433af53a0 Added Reference https://git.kernel.org/stable/c/7610ba1319253225a9ba8a9d28d472fc883b4e2f Added Reference https://git.kernel.org/stable/c/89e0e66682e1538aeeaa3109503473663cd24c8b Added Reference https://git.kernel.org/stable/c/9525b38180e2753f0daa1a522b7767a2aa969676 Added Reference https://git.kernel.org/stable/c/ecd7744a1446eb02ccc63e493e2eb6ede4ef1e10 Added Reference https://git.kernel.org/stable/c/f1bc0d8163f8ee84a8d5affdf624cfad657df1d2 Added Reference https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html Added Reference https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Nov. 05, 2024
Action Type Old Value New Value Removed Reference kernel.org https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html Removed Reference kernel.org https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Jun. 27, 2024
Action Type Old Value New Value Added Reference kernel.org https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html [No types assigned] -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Jun. 25, 2024
Action Type Old Value New Value Added Reference kernel.org https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html [No types assigned] -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
May. 29, 2024
Action Type Old Value New Value -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
May. 14, 2024
Action Type Old Value New Value -
CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Apr. 02, 2024
Action Type Old Value New Value Added Description In the Linux kernel, the following vulnerability has been resolved: blk-mq: fix IO hang from sbitmap wakeup race In blk_mq_mark_tag_wait(), __add_wait_queue() may be re-ordered with the following blk_mq_get_driver_tag() in case of getting driver tag failure. Then in __sbitmap_queue_wake_up(), waitqueue_active() may not observe the added waiter in blk_mq_mark_tag_wait() and wake up nothing, meantime blk_mq_mark_tag_wait() can't get driver tag successfully. This issue can be reproduced by running the following test in loop, and fio hang can be observed in < 30min when running it on my test VM in laptop. modprobe -r scsi_debug modprobe scsi_debug delay=0 dev_size_mb=4096 max_queue=1 host_max_queue=1 submit_queues=4 dev=`ls -d /sys/bus/pseudo/drivers/scsi_debug/adapter*/host*/target*/*/block/* | head -1 | xargs basename` fio --filename=/dev/"$dev" --direct=1 --rw=randrw --bs=4k --iodepth=1 \ --runtime=100 --numjobs=40 --time_based --name=test \ --ioengine=libaio Fix the issue by adding one explicit barrier in blk_mq_mark_tag_wait(), which is just fine in case of running out of tag. Added Reference kernel.org https://git.kernel.org/stable/c/9525b38180e2753f0daa1a522b7767a2aa969676 [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/ecd7744a1446eb02ccc63e493e2eb6ede4ef1e10 [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/7610ba1319253225a9ba8a9d28d472fc883b4e2f [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/89e0e66682e1538aeeaa3109503473663cd24c8b [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/1d9c777d3e70bdc57dddf7a14a80059d65919e56 [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/6d8b01624a2540336a32be91f25187a433af53a0 [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/f1bc0d8163f8ee84a8d5affdf624cfad657df1d2 [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/5266caaf5660529e3da53004b8b7174cab6374ed [No types assigned]
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2024-26671 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2024-26671
weaknesses.