Linux · Linux Kernel · CVE-2024-53090
**Name of the Vulnerable Software and Affected Versions**
Linux kernel versions prior to 6.12.0-rc2-build3+
**Description**
The issue is related to lock recursion in the Linux kernel, specifically in the `afs wake up async call()` function. This function can incur lock recursion when called from AF RXRPC while holding the `->notify lock`. The problem arises when it tries to take a reference on the `afs call` struct to pass it to a work queue, but if `afs call` is already queued, an extraneous reference is created. Calling `afs put call()` may call back into AF RXRPC through `rxrpc kernel shutdown call()`, which might try taking the `->notify lock` again. This case is not very common, so it is deferred to a workqueue.
**Recommendations**
To resolve the issue, update to a version of the Linux kernel that includes the fix for the lock recursion vulnerability.
As a temporary workaround, consider disabling the `afs wake up async call()` function until a patch is available.
Restrict access to the `rxrpc input call event()` function to minimize the risk of exploitation.
Avoid using the `afs call` struct in the affected work queue until the issue is resolved.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.