Deadlock Vulnerability in Linux Kernel Package: linux - Block Device Management
Summary
DEBIAN-CVE-2024-26899: In the Linux kernel, the following vulnerability has been resolved: block: fix deadlock between bd_link_disk_holder and partition scan 'open_mutex' of gendisk is used to protect open/close block devices. Affects linux versions < 6.7.12-1. Fixed in 6.7.12-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The 'linux' package is a core component of the Debian operating system, providing the Linux kernel that manages hardware resources and system processes. It is responsible for facilitating communication between software and hardware, ensuring efficient operation of system tasks. This package is crucial for system stability and performance, making its security paramount. The vulnerability in question affects how block devices are managed, particularly during initialization and modification processes.
Vulnerability Detail
In the Linux kernel, a deadlock vulnerability arises from the improper use of the 'open_mutex' mutex in the bd_link_disk_holder function. This function is intended to create a symlink between a holding disk and a slave block device. However, during the initialization or modification of a driver, if a partition scan occurs while 'open_mutex' is held, it can lead to a deadlock situation. Specifically, when one thread is scanning partitions while another is attempting to add a new device to a RAID array, both threads can end up waiting on each other indefinitely, causing the system to hang.
How To Fix
Minimum fixed version
6.7.12-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the patch as soon as it is available.
Conclusion
The deadlock vulnerability in the Linux kernel package 'linux' poses a significant risk to system stability. It is crucial for users to update to the patched version to mitigate this risk. Regular monitoring and timely updates are essential for maintaining system security.
See every vulnerability recorded for linux →
FAQ
The vulnerability is a deadlock issue in the Linux kernel related to block device management, which can cause system hangs.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which allows you to monitor for vulnerabilities without requiring installation.
If exploited, this vulnerability can lead to system instability and unresponsiveness, affecting the overall performance of the operating system.
Yes, the permanent fix is to update the 'linux' package to version 6.7.12-1 or later, which resolves the deadlock issue.
If immediate updating is not possible, monitor your system closely for signs of instability and plan to apply the update as soon as feasible.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
