cbcvebase.
CVE-2024-41023
published 2024-07-29

CVE-2024-41023: In the Linux kernel, the following vulnerability has been resolved: sched/deadline: Fix task_struct reference leak During the execution of the following stress…

PriorityP419medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.29%
21.5th percentile
In the Linux kernel, the following vulnerability has been resolved: sched/deadline: Fix task_struct reference leak During the execution of the following stress test with linux-rt: stress-ng --cyclic 30 --timeout 30 --minimize --quiet kmemleak frequently reported a memory leak concerning the task_struct: unreferenced object 0xffff8881305b8000 (size 16136): comm "stress-ng", pid 614, jiffies 4294883961 (age 286.412s) object hex dump (first 32 bytes): 02 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 .@.............. 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ debug hex dump (first 16 bytes): 53 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 S............... backtrace: [] dup_task_struct+0x30/0x540 [] copy_process+0x3d9/0x50e0 [] kernel_clone+0xb0/0x770 [] __do_sys_clone+0xb6/0xf0 [] do_syscall_64+0x5d/0xf0 [] entry_SYSCALL_64_after_hwframe+0x6e/0x76 The issue occurs in start_dl_timer(), which increments the task_struct reference count and sets a timer. The timer callback, dl_task_timer, is supposed to decrement the reference count upon expiration. However, if enqueue_task_dl() is called before the timer expires and cancels it, the reference count is not decremented, leading to the leak. This patch fixes the reference leak by ensuring the task_struct reference count is properly decremented when the timer is canceled.

Affected

15 ranges
VendorProductVersion rangeFixed in
debianlinux< linux 6.9.10-1 (forky)linux 6.9.10-1 (forky)
linuxlinux
linuxlinux
linuxlinux
linuxlinux>= 4.19.257 < 4.204.20
linuxlinux>= 5.4.212 < 5.55.5
linuxlinux>= feff2e65efd8d84cf831668e182b2ce73c604bbb < 7a54d31face626f62de415ebe77b43f76c3ffaf47a54d31face626f62de415ebe77b43f76c3ffaf4
linuxlinux>= feff2e65efd8d84cf831668e182b2ce73c604bbb < b58652db66c910c2245f5bee7deca41c12d707b9b58652db66c910c2245f5bee7deca41c12d707b9
linuxlinux_kernel
linuxlinux_kernel>= 0 < 6.9.10-16.9.10-1
linuxlinux_kernel>= 0 < 6.9.10-16.9.10-1
linuxlinux_kernel>= 0 < 6.8.0-48.486.8.0-48.48
linuxlinux_kernel>= 4.19.257 < 4.204.20
linuxlinux_kernel>= 5.10 < 6.9.106.9.10
linuxlinux_kernel>= 5.4.212 < 5.55.5

CVSS provenance

nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
osv5.5MEDIUM
vendor_debian5.5MEDIUM
vendor_redhat5.5MEDIUM
vendor_ubuntu5.5MEDIUM
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.