PT-2025-2981 · Linux · Linux Kernel

Published 2025-01-11 · Updated 2025-01-16 · CVE-2024-53689

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.12.0-10553-gb86545e02e8c

Description A potential deadlock issue has been identified in the Linux kernel. The queue attr store function first freezes the queue (->q usage counter(io)) and then acquires ->sysfs lock. However, the usual ordering should be to acquire ->sysfs lock before freezing the queue. This incorrect ordering causes a lockdep splat, which can be reproduced by accessing the /sys/kernel/debug file using the ls command. The issue is related to the block subsystem and the sysfs interface.

Recommendations To resolve the issue, update the Linux kernel to a version that includes the fix for the potential deadlock. Specifically, for Linux kernel versions prior to 6.12.0-10553-gb86545e02e8c, update to a newer version that includes the corrected queue attr store function. As a temporary workaround, consider disabling the queue attr store function until a patch is available. However, this may have unintended consequences and should be used with caution.

Fix

Improper Locking

Weakness Enumeration

CWE-667

Related Identifiers

CVE-2024-53689

Affected Products

Linux Kernel

References · 10

• https://git.kernel.org/stable/c/f1a494df8350da2e673618627cb392a8669825dd · Patch
• https://git.kernel.org/stable/c/be26ba96421ab0a8fa2055ccf7db7832a13c44d2 · Patch
• https://security-tracker.debian.org/tracker/CVE-2024-53689 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-53689 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-53689 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-53689 · Security Note
• https://osv.dev/vulnerability/CVE-2024-53689 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-53689 · Vendor Advisory
• https://git.kernel.org/linus/be26ba96421ab0a8fa2055ccf7db7832a13c44d2 · Note
• https://twitter.com/CVEnew/status/1878063320164683859 · Twitter Post