CVE-2024-27005: interconnect: Don't access req_list while it's being manipulated

Published May 1, 2024
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

interconnect: Don't access reqlist while it's being manipulated

The icclock mutex was split into separate icclock and iccbwlock mutexes in [1] to avoid lockdep splats. However, this didn't adequately protect access to iccnode::reqlist.

The iccsetbw() function will eventually iterate over reqlist while only holding iccbwlock, but reqlist can be modified while only holding icclock. This causes races between iccsetbw(), oficcget(), and iccput().

Example A:

CPU0 CPU1 ---- ---- iccsetbw(patha) mutexlock(&iccbwlock); iccput(pathb) mutexlock(&icclock); aggregaterequests() hlistforeachentry(r, ... hlistdel(... <r = invalid pointer>

Example B:

CPU0 CPU1 ---- ---- iccsetbw(patha) mutexlock(&iccbwlock); pathb = oficcget() oficcgetbyindex() mutexlock(&icclock); pathfind() pathinit() aggregaterequests() hlistforeachentry(r, ... hlistaddhead(... <r = invalid pointer>

Fix this by ensuring iccbwlock is always held before manipulating iccnode::reqlist. The additional places iccbwlock is held don't perform any memory allocations, so we should still be safe from the original lockdep splats that motivated the separate locks.

[1] commit af42269c3523 ("interconnect: Fix locking for runpm vs reclaim")

Affected Software

12 affected componentsFixes available
Linux Linux kernel>=5.15.133<5.16
Linux Linux kernel>=6.1.55<6.2
Linux Linux kernel>=6.5.5<6.6.29
Linux Linux kernel>=6.7<6.8.8
Linux Linux kernel=6.9-rc1
Linux Linux kernel=6.9-rc2
Linux Linux kernel=6.9-rc3
Linux Linux kernel=6.9-rc4
debian/linux<=6.1.129-1, <=6.1.133-1
5.10.223-15.10.234-16.12.22-16.12.25-1
Microsoft cbl2 kernel 5.15.186.1-1
Microsoft azl3 hyperv-daemons 6.6.22.1-2<6.6.35.1-1
6.6.35.1-1
Microsoft azl3 hyperv-daemons 6.6.35.1-1<6.6.35.1-1
6.6.35.1-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade debian/linux to a version that resolves this vulnerability.

    Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.12.22-1Fixed in 6.12.25-1
  2. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 6.6.35.1-1
  3. Upgrade

    Upgrade Linux kernel interconnect to a version that resolves this vulnerability.

    Patch commit af42269c3523
  4. Configuration

    Apply the resolution for the interconnect locking issue: ensure req_list is not accessed while it is being manipulated by enforcing that icc_bw_lock is always held before manipulating icc_node::req_list. (This is addressed by splitting icc_lock into icc_lock and icc_bw_lock and adjusting access patterns so icc_set_bw() does not iterate over req_list while only holding icc_bw_lock.)

    Linux kernel interconnect code (icc_set_bw / req_list access) Lock ordering for req_list manipulation = Always hold icc_bw_lock before manipulating icc_node::req_list; avoid accessing req_list while it is being manipulated

Event History

May 1, 2024
CVE Published
via MITRE·05:28 AM
Data Sourced
via MITRE·05:28 AM
DescriptionSeverity
Data Sourced
via NVD·06:15 AM
RemedyDescriptionSeverityWeaknessAffected Software
Jul 11, 2024
Data Sourced
via Launchpad·07:45 PM
Description
Sep 11, 2024
Data Sourced
via Microsoft·12:00 AM
DescriptionSeverityWeaknessAffected Software
Updated
via Microsoft·07:00 AM
SeverityAffected Software
Updated
via Microsoft·07:00 AM
DescriptionSeverity
Apr 27, 2025
Data Sourced
via Ubuntu·12:16 AM
RemedyDescriptionSeverityAffected Software

Frequently Asked Questions

1

What is the severity of CVE-2024-27005?

CVE-2024-27005 is classified as a high-severity vulnerability affecting the Linux kernel.

2

How do I fix CVE-2024-27005?

To fix CVE-2024-27005, update your Linux kernel to versions 5.10.223-1, 5.10.226-1, 6.12.10-1, or 6.12.11-1.

3

Which versions of the Linux kernel are affected by CVE-2024-27005?

The affected versions of the Linux kernel for CVE-2024-27005 are up to and including 6.1.123-1 and 6.1.119-1.

4

What components are involved in CVE-2024-27005?

CVE-2024-27005 involves issues with the icc_lock and icc_bw_lock mutexes in the interconnect functionality.

5

Is CVE-2024-27005 exploitable remotely?

The details on whether CVE-2024-27005 can be exploited remotely are not specified, but it typically requires local access.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203