PT-2024-21498 · Linux · Linux Kernel

Yu Kuai · Published 2024-02-15 · Updated 2024-11-08 · CVE-2024-26755

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A potential deadlock in the Linux kernel for raid456 has been identified. The issue occurs when a reshape is interrupted, and a disk is set to WantReplacement, with a new disk added to the array. The recovery process won't start until the reshape is finished, and an IO across the reshape position will wait for the reshape to make progress. Meanwhile, md start sync() finds a spare disk that can be added to the configuration, and mddev suspend() is called, leading to a deadlock. This problem was found by code review and has not been reproduced yet. The fix involves not suspending the array for interrupted reshape, which is safe because the configuration won't be changed until the reshape is done.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Validation of Array Index

Weakness Enumeration

CWE-833

CWE-129

Related Identifiers

BDU:2025-15093

CVE-2024-26755

Affected Products

Linux Kernel

References · 19

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/26xxx/CVE-2024-26755.json · Exploit
• https://git.kernel.org/stable/c/60d6130d0ac1d883ed93c2a1e10aadb60967fd48 · Patch
• https://osv.dev/vulnerability/BELL-CVE-2024-26755 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-26755 · Security Note
• https://osv.dev/vulnerability/CVE-2024-26755 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-26755 · Vendor Advisory
• https://git.kernel.org/stable/c/9e46c70e829bddc24e04f963471e9983a11598b7 · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-26755 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-15093 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2024-26755 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-26755 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-26755 · Security Note
• https://docs.bell-sw.com/security/cves/CVE-2024-26755 · Note
• https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git · Note
• https://lore.kernel.org/linux-cve-announce/2024040303-CVE-2024-26755-947e@gregkh · Note