PT-2024-29232 · Linux+3 · Linux Kernel+3
Published
2024-06-28
·
Updated
2025-09-29
·
CVE-2024-41053
CVSS v2.0
7.5
High
| Vector | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
Linux kernel versions prior to 6.6.43
Description
The issue arises when
ufshcd abort one is racing with the completion ISR, causing the completed tag of the request's mq hctx pointer to be set to NULL by ISR. This results in a kernel NULL pointer dereference. The racing flow involves two threads: Thread A, which calls ufshcd err handler, ufshcd abort one, ufshcd try to abort task, and ufshcd mcq req to hwq, and Thread B, which calls ufs mtk mcq intr (cq complete ISR), scsi done, and blk mq free request. The backtrace shows the error occurring at blk mq unique tag+0x8/0x14.Recommendations
To resolve the issue, update the Linux kernel to version 6.6.43 or later. As a temporary workaround, consider disabling the
ufshcd abort one function until a patch is available. Restrict access to the vulnerable ufshcd mcq req to hwq module to minimize the risk of exploitation. Avoid using the rq->mq hctx->queue num parameter in the affected API endpoint until the issue is resolved.Exploit
Fix
NULL Pointer Dereference
Race Condition
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Linuxmint
Linux Kernel
Ubuntu