CVE-2024-35974: block: fix q->blkg_list corruption during disk rebind
In the Linux kernel, the following vulnerability has been resolved:
block: fix q->blkglist corruption during disk rebind
Multiple gendisk instances can allocated/added for single request queue in case of disk rebind. blkg may still stay in q->blkglist when calling blkcginitdisk() for rebind, then q->blkglist becomes corrupted.
Fix the list corruption issue by:
- add blkginitqueue() to initialize q->blkglist & q->blkcgmutex only - move calling blkginitqueue() into blkallocqueue()
The list corruption should be started since commit f1c006f1c685 ("blk-cgroup: synchronize pdfreefn() from blkgfreeworkfn() and blkcgdeactivatepolicy()") which delays removing blkg from q->blkglist into blkgfreeworkfn().
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-35974?
CVE-2024-35974 has a medium severity level due to potential corruption of the request queue.
How do I fix CVE-2024-35974?
To fix CVE-2024-35974, upgrade to the fixed versions 5.10.223-1, 5.10.226-1, or 6.12.12-1 of the Linux kernel.
Which Linux kernel versions are affected by CVE-2024-35974?
CVE-2024-35974 affects Linux kernel versions up to and including 6.1.128-1.
What components are involved in CVE-2024-35974?
CVE-2024-35974 involves the block layer and request queues within the Linux kernel.
Is CVE-2024-35974 a local or remote vulnerability?
CVE-2024-35974 is considered a local vulnerability as it requires local privileges to exploit.