CVE-2024-35808

MEDIUM

Linux Kernel 3.10-6.7.11, 6.8.0-6.8.2 - Denial of Service via Improper Locking in md/dm-raid

Title source: llm
STIX 2.1

Description

In the Linux kernel, the following vulnerability has been resolved: md/dm-raid: don't call md_reap_sync_thread() directly Currently md_reap_sync_thread() is called from raid_message() directly without holding 'reconfig_mutex', this is definitely unsafe because md_reap_sync_thread() can change many fields that is protected by 'reconfig_mutex'. However, hold 'reconfig_mutex' here is still problematic because this will cause deadlock, for example, commit 130443d60b1b ("md: refactor idle/frozen_sync_thread() to fix deadlock"). Fix this problem by using stop_sync_thread() to unregister sync_thread, like md/raid did.

Scores

CVSS v3 5.5
EPSS 0.0017
EPSS Percentile 7.0%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-667
Status published
Products (11)
linux/Kernel 3.10.0 - 6.7.12linux
linux/Kernel 6.8.0 - 6.8.3linux
Linux/Linux < 3.10
Linux/Linux 3.10
Linux/Linux 6.7.12 - 6.7.*
Linux/Linux 6.8.3 - 6.8.*
Linux/Linux 6.9
Linux/Linux be83651f0050ca8621d58d35dad558e9c45cb18f - 347dcdc15a1706f61aa545ae498ededdf31aeebc
Linux/Linux be83651f0050ca8621d58d35dad558e9c45cb18f - 9e59b8d76ff511505eb0dd1478329f09e0f04669
Linux/Linux be83651f0050ca8621d58d35dad558e9c45cb18f - cd32b27a66db8776d8b8e82ec7d7dde97a8693b0
... and 1 more
Published May 17, 2024
Tracked Since Feb 18, 2026