CVE-2024-27023

md: Fix missing release of 'active_io' for flush

Description

In the Linux kernel, the following vulnerability has been resolved: md: Fix missing release of 'active_io' for flush submit_flushes atomic_set(&mddev->flush_pending, 1); rdev_for_each_rcu(rdev, mddev) atomic_inc(&mddev->flush_pending); bi->bi_end_io = md_end_flush submit_bio(bi); /* flush io is done first */ md_end_flush if (atomic_dec_and_test(&mddev->flush_pending)) percpu_ref_put(&mddev->active_io) -> active_io is not released if (atomic_dec_and_test(&mddev->flush_pending)) -> missing release of active_io For consequence, mddev_suspend() will wait for 'active_io' to be zero forever. Fix this problem by releasing 'active_io' in submit_flushes() if 'flush_pending' is decreased to zero.

N/A

CVSS

Severity:

EPSS 0.13%

Affected: Linux Linux

References

Link	Tags
https://git.kernel.org/stable/c/6b2ff10390b19a2364af622b6666b690443f9f3f
https://git.kernel.org/stable/c/02dad157ba11064d073f5499dc33552b227d5d3a
https://git.kernel.org/stable/c/11f81438927f84edfaaeb5d5f10856c3a1c1fc82
https://git.kernel.org/stable/c/855678ed8534518e2b428bcbcec695de9ba248e8

Frequently Asked Questions

What is the severity of CVE-2024-27023?: CVE-2024-27023 has not yet been assigned a CVSS score.
How to fix CVE-2024-27023?: To fix CVE-2024-27023, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2024-27023 being actively exploited in the wild?: As for now, there are no information to confirm that CVE-2024-27023 is being actively exploited. According to its EPSS score, there is a ~0% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2024-27023?: CVE-2024-27023 affects Linux Linux, Linux Linux.

This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.