CVE-2024-50122: PCI: Hold rescan lock while adding devices during host probe
In the Linux kernel, the following vulnerability has been resolved:
PCI: Hold rescan lock while adding devices during host probe
Since adding the PCI power control code, we may end up with a race between the pwrctl platform device rescanning the bus and host controller probe functions. The latter need to take the rescan lock when adding devices or we may end up in an undefined state having two incompletely added devices and hit the following crash when trying to remove the device over sysfs:
Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 Internal error: Oops: 0000000096000004 [#1] SMP Call trace: pistrlen+0x14/0x150 kernfsfindns+0x80/0x13c kernfsremovebynamens+0x54/0xf0 sysfsremovebinfile+0x24/0x34 pciremoveresourcefiles+0x3c/0x84 pciremovesysfsdevfiles+0x28/0x38 pcistopbusdevice+0x8c/0xd8 pcistopbusdevice+0x40/0xd8 pcistopandremovebusdevicelocked+0x28/0x48 removestore+0x70/0xb0 devattrstore+0x20/0x38 sysfskfwrite+0x58/0x78 kernfsfopwriteiter+0xe8/0x184 vfswrite+0x2dc/0x308 ksyswrite+0x7c/0xec
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-50122?
CVE-2024-50122 is categorized as a medium severity vulnerability in the Linux kernel.
How do I fix CVE-2024-50122?
To fix CVE-2024-50122, update your Linux kernel to a version greater than 6.12-rc4.
Which Linux kernel versions are affected by CVE-2024-50122?
CVE-2024-50122 affects Linux kernel versions from 6.11 to 6.12-rc4.
What does CVE-2024-50122 affect?
CVE-2024-50122 affects the PCI subsystem within the Linux kernel, specifically during device probing.
Is CVE-2024-50122 being exploited in the wild?
As of now, there is no evidence suggesting that CVE-2024-50122 is being actively exploited.