CVE-2024-56709
MEDIUMLinux Kernel 5.14.1-6.1.121, 6.2.0-6.6.67, 6.7.0-6.12.6 - Denial of Service via io_uring Task Work Race Condition
Title source: llmDescription
In the Linux kernel, the following vulnerability has been resolved: io_uring: check if iowq is killed before queuing task work can be executed after the task has gone through io_uring termination, whether it's the final task_work run or the fallback path. In this case, task work will find ->io_wq being already killed and null'ed, which is a problem if it then tries to forward the request to io_queue_iowq(). Make io_queue_iowq() fail requests in this case. Note that it also checks PF_KTHREAD, because the user can first close a DEFER_TASKRUN ring and shortly after kill the task, in which case ->iowq check would race.
References (5)
Core 5
Core References
Scores
CVSS v3
5.5
EPSS
0.0022
EPSS Percentile
12.0%
Attack Vector
LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Details
Status
published
Products (16)
linux/Kernel
5.14.0 - 6.1.122linux
linux/Kernel
6.2.0 - 6.6.68linux
linux/Kernel
6.7.0 - 6.12.7linux
Linux/Linux
< 5.14
Linux/Linux
5.14
Linux/Linux
6.1.122 - 6.1.*
Linux/Linux
6.12.7 - 6.12.*
Linux/Linux
6.13
Linux/Linux
6.6.68 - 6.6.*
Linux/Linux
773af69121ecc6c53d192661af8d53bb3db028ae - 2ca94c8de36091067b9ce7527ae8db3812d38781
... and 6 more
Published
Dec 29, 2024
Tracked Since
Feb 18, 2026