CVE-2024-40995

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

net/sched: act_api: fix possible infinite loop in tcf_idr_check_alloc()

syzbot found hanging tasks waiting on rtnl_lock [1]

A reproducer is available in the syzbot bug.

When a request to add multiple actions with the same index is sent, the

second request will block forever on the first request. This holds

rtnl_lock, and causes tasks to hang.

Return -EAGAIN to prevent infinite looping, while keeping documented

behavior.

[1]

INFO: task kworker/1:0:5088 blocked for more than 143 seconds.

Not tainted 6.9.0-rc4-syzkaller-00173-g3cdb45594619 #0

"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.

task:kworker/1:0 state:D stack:23744 pid:5088 tgid:5088 ppid:2 flags:0x00004000

Workqueue: events_power_efficient reg_check_chans_work

Call Trace:

<TASK>

context_switch kernel/sched/core.c:5409 [inline]

__schedule+0xf15/0x5d00 kernel/sched/core.c:6746

__schedule_loop kernel/sched/core.c:6823 [inline]

sch

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References