PT-2024-21499 · Linux+3 · Linux Kernel+3

Published 2024-04-03 · Updated 2026-05-26 · CVE-2024-26756

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The issue arises when the reshape function is interrupted, causing the reassemble array to register the sync thread directly, which can lead to a hang in the stop sync thread() function. This occurs because 'MD RECOVERY RUNNING' is set directly without guaranteeing the execution of md do sync(), making it impossible to clear 'MD RECOVERY RUNNING'. The problem can be triggered occasionally by the dm-raid test shell/lvconvert-raid-reshape.sh. Technical details include the involvement of functions such as stop sync thread(), md frozen sync thread(), raid presuspend(), and dm table presuspend targets(), indicating a complex interaction within the Linux kernel's handling of RAID and device management. The state of mddev->recovery is set to MD RECOVERY RUNNING | MD RECOVERY INTR | MD RECOVERY RESHAPE | MD RECOVERY FROZEN, further complicating the recovery process.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-459

Related Identifiers

ALSA-2025_12746

ALSA-2025_12752

ALSA-2025_12753

ALSA-2025_16880

ALT-PU-2025-12647

AZL-58753

AZL-58801

CVE-2024-26756

ECHO-B6D2-31AA-7D53

SUSE-SU-2024:2135-1

SUSE-SU-2024:2973-1

Affected Products

Alt Linux

Debian

Linux Kernel

Suse

References · 1791

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/26xxx/CVE-2024-26756.json · Exploit
• https://osv.dev/vulnerability/ROOT-OS-UBUNTU-2204-CVE-2024-26756 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-OS-DEBIAN-11-CVE-2024-26756 · Vendor Advisory
• https://git.kernel.org/stable/c/ad39c08186f8a0f221337985036ba86731d6aafe · Patch
• https://osv.dev/vulnerability/CVE-2024-26756 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2024:2135-1 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-OS-DEBIAN-12-CVE-2024-26756 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-26756 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-26756 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2024:2973-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-26756 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-26756 · Vendor Advisory
• https://git.kernel.org/stable/c/13b520fb62b772e408f9b79c5fe18ad414e90417 · Patch
• https://osv.dev/vulnerability/AZL-58753 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-58801 · Vendor Advisory