CVE-2024-56709

MEDIUM

Linux Kernel 5.14.1-6.1.121, 6.2.0-6.6.67, 6.7.0-6.12.6 - Denial of Service via io_uring Task Work Race Condition

Title source: llm
STIX 2.1

Description

In the Linux kernel, the following vulnerability has been resolved: io_uring: check if iowq is killed before queuing task work can be executed after the task has gone through io_uring termination, whether it's the final task_work run or the fallback path. In this case, task work will find ->io_wq being already killed and null'ed, which is a problem if it then tries to forward the request to io_queue_iowq(). Make io_queue_iowq() fail requests in this case. Note that it also checks PF_KTHREAD, because the user can first close a DEFER_TASKRUN ring and shortly after kill the task, in which case ->iowq check would race.

Scores

CVSS v3 5.5
EPSS 0.0022
EPSS Percentile 12.0%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Details

Status published
Products (16)
linux/Kernel 5.14.0 - 6.1.122linux
linux/Kernel 6.2.0 - 6.6.68linux
linux/Kernel 6.7.0 - 6.12.7linux
Linux/Linux < 5.14
Linux/Linux 5.14
Linux/Linux 6.1.122 - 6.1.*
Linux/Linux 6.12.7 - 6.12.*
Linux/Linux 6.13
Linux/Linux 6.6.68 - 6.6.*
Linux/Linux 773af69121ecc6c53d192661af8d53bb3db028ae - 2ca94c8de36091067b9ce7527ae8db3812d38781
... and 6 more
Published Dec 29, 2024
Tracked Since Feb 18, 2026