CVE-2024-49956: gfs2: fix double destroy_workqueue error
In the Linux kernel, the following vulnerability has been resolved:
gfs2: fix double destroyworkqueue error
When gfs2fillsuper() fails, destroyworkqueue() is called within gfs2glhashclear(), and the subsequent code path calls destroyworkqueue() on the same work queue again.
This issue can be fixed by setting the work queue pointer to NULL after the first destroyworkqueue() call and checking for a NULL pointer before attempting to destroy the work queue again.
Other sources
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.22-1Fixed in 6.12.25-1 - Configuration
When gfs2_fill_super() fails and destroy_workqueue() is called within gfs2_gl_hash_clear(), set the affected work queue pointer to NULL immediately after the first destroy_workqueue() call, and add a NULL-pointer check so destroy_workqueue() is not invoked again on the same work queue in the subsequent code path.
Linux kernel (gfs2) workqueue pointer (gfs2 gl hash workqueue) = NULL after first destroy_workqueue() call; check for NULL before second destroy_workqueue()
Event History
Frequently Asked Questions
What is the severity of CVE-2024-49956?
CVE-2024-49956 is classified as a low severity vulnerability affecting the Linux kernel.
How do I fix CVE-2024-49956?
To fix CVE-2024-49956, update the Linux kernel to versions 5.10.223-1, 5.10.226-1, 6.1.123-1, 6.1.128-1, 6.12.12-1, or 6.12.15-1.
Which versions of the Linux kernel are affected by CVE-2024-49956?
CVE-2024-49956 affects the Linux kernel versions 6.11 and earlier.
What is the impact of CVE-2024-49956 on systems?
CVE-2024-49956 can lead to a potential denial of service due to the double destruction of a work queue.
Is CVE-2024-49956 specific to any particular Linux distribution?
CVE-2024-49956 affects the Linux kernel across multiple distributions, including Debian.