REDHAT-BUG-2348240: Low severity Linux Kernel vulnerability

Published Feb 26, 2025
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

list: fix a data-race around ep->rdllist

eppoll() first calls epeventsavailable() with no lock held and checks if ep->rdllist is empty by listemptycareful(), which reads rdllist->prev. Thus all accesses to it need some protection to avoid store/load-tearing.

Note INITLISTHEADRCU() already has the annotation for both prev and next.

Commit bf3b9f6372c4 ("epoll: Add busy poll support to epoll with socket fds.") added the first lockless epeventsavailable(), and commit c5a282e9635e ("fs/epoll: reduce the scope of wq lock in epollwait()") made some epeventsavailable() calls lockless and added single call under a lock, finally commit e59d3c64cba6 ("epoll: eliminate unnecessary lock for zero timeout") made the last epeventsavailable() lockless.

BUG: KCSAN: data-race in doepollwait / doepollwait

write to 0xffff88810480c7d8 of 8 bytes by task 1802 on cpu 0: INITLISTHEAD include/linux/list.h:38 [inline] listspliceinit include/linux/list.h:492 [inline] epstartscan fs/eventpoll.c:622 [inline] epsendevents fs/eventpoll.c:1656 [inline] eppoll fs/eventpoll.c:1806 [inline] doepollwait+0x4eb/0xf40 fs/eventpoll.c:2234 doepollpwait fs/eventpoll.c:2268 [inline] dosysepollpwait fs/eventpoll.c:2281 [inline] sesysepollpwait+0x12b/0x240 fs/eventpoll.c:2275 x64sysepollpwait+0x74/0x80 fs/eventpoll.c:2275 dosyscallx64 arch/x86/entry/common.c:50 [inline] dosyscall64+0x44/0xd0 arch/x86/entry/common.c:80 entrySYSCALL64afterhwframe+0x44/0xae

read to 0xffff88810480c7d8 of 8 bytes by task 1799 on cpu 1: listemptycareful include/linux/list.h:329 [inline] epeventsavailable fs/eventpoll.c:381 [inline] eppoll fs/eventpoll.c:1797 [inline] doepollwait+0x279/0xf40 fs/eventpoll.c:2234 doepollpwait fs/eventpoll.c:2268 [inline] dosysepollpwait fs/eventpoll.c:2281 [inline] sesysepollpwait+0x12b/0x240 fs/eventpoll.c:2275 x64sysepollpwait+0x74/0x80 fs/eventpoll.c:2275 dosyscallx64 arch/x86/entry/common.c:50 [inline] dosyscall64+0x44/0xd0 arch/x86/entry/common.c:80 entrySYSCALL64afterhwframe+0x44/0xae

value changed: 0xffff88810480c7d0 -> 0xffff888103c15098

Reported by Kernel Concurrency Sanitizer on: CPU: 1 PID: 1799 Comm: syz-fuzzer Tainted: G W 5.17.0-rc7-syzkaller-dirty #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011

Affected Software

1 affected component
Linux Kernel

Event History

Feb 26, 2025
Data Sourced
via Red Hat·03:22 AM
DescriptionSeverityAffected Software
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is the severity of REDHAT-BUG-2348240?

The vulnerability REDHAT-BUG-2348240 is classified as high severity due to potential data race conditions in the Linux kernel.

2

How do I fix REDHAT-BUG-2348240?

To fix REDHAT-BUG-2348240, you should update your Linux kernel to the latest version that includes the patch for this vulnerability.

3

What versions of the Linux kernel are affected by REDHAT-BUG-2348240?

All versions of the Linux kernel prior to the patch release addressing REDHAT-BUG-2348240 are potentially affected.

4

What are the potential impacts of REDHAT-BUG-2348240?

The potential impacts of REDHAT-BUG-2348240 include system instability and possible unauthorized access to sensitive data due to the data race.

5

Is REDHAT-BUG-2348240 exploit code available?

Currently, there is no known exploit code publicly available for REDHAT-BUG-2348240, but it is advisable to patch it promptly.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203