CVE-2024-53090

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

afs: Fix lock recursion

afs_wake_up_async_call() can incur lock recursion. The problem is that it

is called from AF_RXRPC whilst holding the ->notify_lock, but it tries to

take a ref on the afs_call struct in order to pass it to a work queue - but

if the afs_call is already queued, we then have an extraneous ref that must

be put... calling afs_put_call() may call back down into AF_RXRPC through

rxrpc_kernel_shutdown_call(), however, which might try taking the

->notify_lock again.

This case isn't very common, however, so defer it to a workqueue. The oops

looks something like:

BUG: spinlock recursion on CPU#0, krxrpcio/7001/1646

lock: 0xffff888141399b30, .magic: dead4ead, .owner: krxrpcio/7001/1646, .owner_cpu: 0

CPU: 0 UID: 0 PID: 1646 Comm: krxrpcio/7001 Not tainted 6.12.0-rc2-build3+ #4351

Hardware name: ASUS All Series/H97-PLUS, BIOS 2306 10/09/2014

Call Trace:

<TASK>

dump_stack_lvl+0x47/0x70

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References