CVE-2024-26671: blk-mq: fix IO hang from sbitmap wakeup race
blk-mq: fix IO hang from sbitmap wakeup race
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 4.19.307 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 5.4.269 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 5.10.210 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 5.15.149 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.1.77 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.6.16 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.7.4 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.8 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.82.1-1 - Upgrade
Upgrade
Linux kernelto a version that resolves this vulnerability.Patch CVE-2024-26671 - Compensating control
If you need a workaround while a fixed kernel is not available, unload the affected test module 'scsi_debug' (e.g., 'modprobe -r scsi_debug') and avoid running the fio workload that triggers the blk-mq IO hang race (blk-mq_mark_tag_wait() / sbitmap wakeup race).
- Compensating control
Ensure the test reproducer is not running by restarting the 'scsi_debug' module with the settings shown after unloading it (e.g., 'modprobe scsi_debug delay=0 dev_size_mb=4096 max_queue=1 host_max_queue=1 submit_queues=4') before rerunning fio, so you can validate whether the hang is still observable.
Event History
Frequently Asked Questions
What is the severity of CVE-2024-26671?
CVE-2024-26671 is considered a medium severity vulnerability affecting the Linux kernel.
How do I fix CVE-2024-26671?
To fix CVE-2024-26671, update the Linux kernel to the fixed versions specified in the vulnerability details.
Which Linux kernel versions are affected by CVE-2024-26671?
CVE-2024-26671 affects various versions of the Linux kernel, including versions prior to 4.19.307, 5.4.269, 5.10.210, 5.15.149, 6.1.77, 6.6.16, 6.7.4, and 6.8.
What type of systems are impacted by CVE-2024-26671?
Systems running vulnerable versions of the Linux kernel on Red Hat and Debian distributions are impacted by CVE-2024-26671.
What are the potential consequences of CVE-2024-26671?
Exploiting CVE-2024-26671 may lead to an IO hang due to race conditions in the block layer of the Linux kernel.