Double Workqueue Destruction Vulnerability in Linux Kernel
Summary
DEBIAN-CVE-2024-49956: In the Linux kernel, the following vulnerability has been resolved: gfs2: fix double destroy_workqueue error When gfs2_fill_super() fails, destroy_workqueue() is called within gfs2_gl_hash_clear(), and the subsequent cod... Affects linux versions < 6.11.4-1. Fixed in 6.11.4-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, including Debian. It manages system resources and hardware communication, providing essential services for software applications. The kernel is known for its stability and performance, but like any complex software, it can have vulnerabilities. This specific vulnerability affects the gfs2 file system implementation within the Linux kernel, which is responsible for managing clustered file systems.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the gfs2 file system where the function gfs2_fill_super() can fail, leading to a double call to destroy_workqueue() on the same work queue. This can result in undefined behavior, potential system crashes, or resource leaks. The issue arises because the work queue pointer is not set to NULL after the first call to destroy_workqueue(), allowing a subsequent call to attempt to destroy the same work queue again.
How To Fix
Minimum fixed version
6.11.4-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the patch by updating to the fixed version of the Linux kernel.
Conclusion
The double workqueue destruction vulnerability in the Linux kernel poses significant risks to system stability and performance. Users are urged to update to the patched version 6.11.4-1 to mitigate these risks. Regular updates and monitoring for vulnerabilities are essential for maintaining system security.
See every vulnerability recorded for linux →
FAQ
The vulnerability can lead to undefined behavior, potential system crashes, or resource leaks due to the double destruction of the work queue.
You can use tools like Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected.
The vulnerability affects the Linux kernel versions prior to 6.11.4-1 in Debian 13 and 14.
While the primary risk is system instability, there is a potential for data loss if the system crashes unexpectedly due to this vulnerability.
It is recommended to regularly check for updates and apply them promptly to ensure your system is secure against known vulnerabilities.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
