CVE-2024-26756

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

md: Don't register sync_thread for reshape directly

Currently, if reshape is interrupted, then reassemble the array will

register sync_thread directly from pers->run(), in this case

'MD_RECOVERY_RUNNING' is set directly, however, there is no guarantee

that md_do_sync() will be executed, hence stop_sync_thread() will hang

because 'MD_RECOVERY_RUNNING' can't be cleared.

Last patch make sure that md_do_sync() will set MD_RECOVERY_DONE,

however, following hang can still be triggered by dm-raid test

shell/lvconvert-raid-reshape.sh occasionally:

[root@fedora ~]# cat /proc/1982/stack

[<0>] stop_sync_thread+0x1ab/0x270 [md_mod]

[<0>] md_frozen_sync_thread+0x5c/0xa0 [md_mod]

[<0>] raid_presuspend+0x1e/0x70 [dm_raid]

[<0>] dm_table_presuspend_targets+0x40/0xb0 [dm_mod]

[<0>] __dm_destroy+0x2a5/0x310 [dm_mod]

[<0>] dm_destroy+0x16/0x30 [dm_mod]

[<0>] dev_remove+0x165/0x290 [dm_mod]

[<0>] ctl_ioctl+0x4bb/0x7b0 [dm_mod]

[<0>] d

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References