cbcvebase.
CVE-2024-26781
published 2024-04-04

CVE-2024-26781: In the Linux kernel, the following vulnerability has been resolved: mptcp: fix possible deadlock in subflow diag Syzbot and Eric reported a lockdep splat in…

PriorityP419medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.17%
6.9th percentile
In the Linux kernel, the following vulnerability has been resolved: mptcp: fix possible deadlock in subflow diag Syzbot and Eric reported a lockdep splat in the subflow diag: WARNING: possible circular locking dependency detected 6.8.0-rc4-syzkaller-00212-g40b9385dd8e6 #0 Not tainted syz-executor.2/24141 is trying to acquire lock: ffff888045870130 (k-sk_lock-AF_INET6){+.+.}-{0:0}, at: tcp_diag_put_ulp net/ipv4/tcp_diag.c:100 [inline] ffff888045870130 (k-sk_lock-AF_INET6){+.+.}-{0:0}, at: tcp_diag_get_aux+0x738/0x830 net/ipv4/tcp_diag.c:137 but task is already holding lock: ffffc9000135e488 (&h->lhash2[i].lock){+.+.}-{2:2}, at: spin_lock include/linux/spinlock.h:351 [inline] ffffc9000135e488 (&h->lhash2[i].lock){+.+.}-{2:2}, at: inet_diag_dump_icsk+0x39f/0x1f80 net/ipv4/inet_diag.c:1038 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #1 (&h->lhash2[i].lock){+.+.}-{2:2}: lock_acquire+0x1e3/0x530 kernel/locking/lockdep.c:5754 __raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline] _raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:154 spin_lock include/linux/spinlock.h:351 [inline] __inet_hash+0x335/0xbe0 net/ipv4/inet_hashtables.c:743 inet_csk_listen_start+0x23a/0x320 net/ipv4/inet_connection_sock.c:1261 __inet_listen_sk+0x2a2/0x770 net/ipv4/af_inet.c:217 inet_listen+0xa3/0x110 net/ipv4/af_inet.c:239 rds_tcp_listen_init+0x3fd/0x5a0 net/rds/tcp_listen.c:316 rds_tcp_init_net+0x141/0x320 net/rds/tcp.c:577 ops_init+0x352/0x610 net/core/net_namespace.c:136 __register_pernet_operations net/core/net_namespace.c:1214 [inline] register_pernet_operations+0x2cb/0x660 net/core/net_namespace.c:1283 register_pernet_device+0x33/0x80 net/core/net_namespace.c:1370 rds_tcp_init+0x62/0xd0 net/rds/tcp.c:735 do_one_initcall+0x238/0x830 init/main.c:1236 do_initcall_level+0x157/0x210 init/main.c:1298 do_initcalls+0x3f/0x80 init/main.c:1314 kernel_init_freeable+0x42f/0x5d0 init/main.c:1551 kernel_init+0x1d/0x2a0 init/main.c:14

Affected

22 ranges
VendorProductVersion rangeFixed in
debiandebian_linux——
debianlinux< linux 6.1.82-1 (bookworm)linux 6.1.82-1 (bookworm)
linuxlinux>= 298ac00da8e6bc2dcd690b45108acbd944c347d3 < d487e7ba1bc7444d5f062c4930ef8436c47c7e63d487e7ba1bc7444d5f062c4930ef8436c47c7e63
linuxlinux>= 5.10.211 < 5.10.2125.10.212
linuxlinux>= 5.15.150 < 5.15.1515.15.151
linuxlinux>= 6.1.80 < 6.1.816.1.81
linuxlinux>= 6.6.19 < 6.6.216.6.21
linuxlinux>= 6.7.7 < 6.7.96.7.9
linuxlinux>= 71787c665d09a970b9280c285181d3a2d1bf3bb0 < f27d319df055629480b84b9288a502337b6f2a2ef27d319df055629480b84b9288a502337b6f2a2e
linuxlinux>= 7d6e8d7ee13b876e762b11f4ec210876ab7aec84 < cc32ba2fdf3f8b136619fff551f166ba51ec856dcc32ba2fdf3f8b136619fff551f166ba51ec856d
linuxlinux>= 8affdbb3e2ef6b6a3a467b87dc336dc601dc2ed9 < 70e5b013538d5e4cb421afed431a5fcd2a5d49ee70e5b013538d5e4cb421afed431a5fcd2a5d49ee
linuxlinux>= b8adb69a7d29c2d33eb327bca66476fb6066516b < d6a9608af9a75d13243d217f6ce1e30e57d56ffed6a9608af9a75d13243d217f6ce1e30e57d56ffe
linuxlinux>= e074c8297ee421e7ff352404262fe0e042954ab7 < fa8c776f4c323a9fbc8ddf25edcb962083391430fa8c776f4c323a9fbc8ddf25edcb962083391430
linuxlinux_kernel——
linuxlinux_kernel——
linuxlinux_kernel——
linuxlinux_kernel>= 0 < 5.10.216-15.10.216-1
linuxlinux_kernel>= 0 < 6.1.82-16.1.82-1
linuxlinux_kernel>= 0 < 6.7.9-16.7.9-1
linuxlinux_kernel>= 0 < 6.7.9-16.7.9-1
linuxlinux_kernel>= 6.6.19 < 6.6.216.6.21
linuxlinux_kernel>= 6.7.7 < 6.7.96.7.9

CVSS provenance

nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
osv5.5MEDIUM
vendor_debian5.5MEDIUM
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.