{ "cveId": "CVE-2024-26781", "url": "https://patchblox.com/security/cve/CVE-2024-26781", "summary": "CVE-2024-26781 is fixed in linux on 1 platform, first by DEBIAN-CVE-2024-26781, released April 4, 2024. It is not reported as exploited. Patch Radar priority: Routine.", "title": "linux: In the Linux kernel, the following vulnerability has been resolved: mptcp: fix possible deadlock in subflow diag Sy...", "description": "In the Linux kernel, the following vulnerability has been resolved: mptcp: fix possible deadlock in subflow diag Syzbot and Eric reported a lockdep splat in the subflow diag: WARNING: possible circular locking dependency detected 6.8.0-rc4-syzkaller-00212-g40b9385dd8e6 #0 Not tainted syz-executor.2/24141 is trying to acquire lock: ffff888045870130 (k-sk_lock-AF_INET6){\u002B.\u002B.}-{0:0}, at: tcp_diag_put_ulp net/ipv4/tcp_diag.c:100 [inline] ffff888045870130 (k-sk_lock-AF_INET6){\u002B.\u002B.}-{0:0}, at: tcp_diag_get_aux\u002B0x738/0x830 net/ipv4/tcp_diag.c:137 but task is already holding lock: ffffc9000135e488 (\u0026h-\u003Elhash2[i].lock){\u002B.\u002B.}-{2:2}, at: spin_lock include/linux/spinlock.h:351 [inline] ffffc9000135e488 (\u0026h-\u003Elhash2[i].lock){\u002B.\u002B.}-{2:2}, at: inet_diag_dump_icsk\u002B0x39f/0x1f80 net/ipv4/inet_diag.c:1038 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -\u003E #1 (\u0026h-\u003Elhash2[i].lock){\u002B.\u002B.}-{2:2}: lock_acquire\u002B0x1e3/0x530 kernel/locking/lockdep.c:5754 __raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline] _raw_spin_lock\u002B0x2e/0x40 kernel/locking/spinlock.c:154 spin_lock include/linux/spinlock.h:351 [inline] __inet_hash\u002B0x335/0xbe0 net/ipv4/inet_hashtables.c:743 inet_csk_listen_start\u002B0x23a/0x320 net/ipv4/inet_connection_sock.c:1261 __inet_listen_sk\u002B0x2a2/0x770 net/ipv4/af_inet.c:217 inet_listen\u002B0xa3/0x110 net/ipv4/af_inet.c:239 rds_tcp_listen_init\u002B0x3fd/0x5a0 net/rds/tcp_listen.c:316 rds_tcp_init_net\u002B0x141/0x320 net/rds/tcp.c:577 ops_init\u002B0x352/0x610 net/core/net_namespace.c:136 __register_pernet_operations net/core/net_namespace.c:1214 [inline] register_pernet_operations\u002B0x2cb/0x660 net/core/net_namespace.c:1283 register_pernet_device\u002B0x33/0x80 net/core/net_namespace.c:1370 rds_tcp_init\u002B0x62/0xd0 net/rds/tcp.c:735 do_one_initcall\u002B0x238/0x830 init/main.c:1236 do_initcall_level\u002B0x157/0x210 init/main.c:1298 do_initcalls\u002B0x3f/0x80 init/main.c:1314 kernel_init_freeable\u002B0x42f/0x5d0 init/main.c:1551 kernel_init\u002B0x1d/0x2a0 init/main.c:1441 ret_from_fork\u002B0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm\u002B0x1b/0x30 arch/x86/entry/entry_64.S:242 -\u003E #0 (k-sk_lock-AF_INET6){\u002B.\u002B.}-{0:0}: check_prev_add kernel/locking/lockdep.c:3134 [inline] check_prevs_add kernel/locking/lockdep.c:3253 [inline] validate_chain\u002B0x18ca/0x58e0 kernel/locking/lockdep.c:3869 __lock_acquire\u002B0x1345/0x1fd0 kernel/locking/lockdep.c:5137 lock_acquire\u002B0x1e3/0x530 kernel/locking/lockdep.c:5754 lock_sock_fast include/net/sock.h:1723 [inline] subflow_get_info\u002B0x166/0xd20 net/mptcp/diag.c:28 tcp_diag_put_ulp net/ipv4/tcp_diag.c:100 [inline] tcp_diag_get_aux\u002B0x738/0x830 net/ipv4/tcp_diag.c:137 inet_sk_diag_fill\u002B0x10ed/0x1e00 net/ipv4/inet_diag.c:345 inet_diag_dump_icsk\u002B0x55b/0x1f80 net/ipv4/inet_diag.c:1061 __inet_diag_dump\u002B0x211/0x3a0 net/ipv4/inet_diag.c:1263 inet_diag_dump_compat\u002B0x1c1/0x2d0 net/ipv4/inet_diag.c:1371 netlink_dump\u002B0x59b/0xc80 net/netlink/af_netlink.c:2264 __netlink_dump_start\u002B0x5df/0x790 net/netlink/af_netlink.c:2370 netlink_dump_start include/linux/netlink.h:338 [inline] inet_diag_rcv_msg_compat\u002B0x209/0x4c0 net/ipv4/inet_diag.c:1405 sock_diag_rcv_msg\u002B0xe7/0x410 netlink_rcv_skb\u002B0x1e3/0x430 net/netlink/af_netlink.c:2543 sock_diag_rcv\u002B0x2a/0x40 net/core/sock_diag.c:280 netlink_unicast_kernel net/netlink/af_netlink.c:1341 [inline] netlink_unicast\u002B0x7ea/0x980 net/netlink/af_netlink.c:1367 netlink_sendmsg\u002B0xa3b/0xd70 net/netlink/af_netlink.c:1908 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg\u002B0x221/0x270 net/socket.c:745 ____sys_sendmsg\u002B0x525/0x7d0 net/socket.c:2584 ___sys_sendmsg net/socket.c:2638 [inline] __sys_sendmsg\u002B0x2b0/0x3a0 net/socket.c:2667 do_syscall_64\u002B0xf9/0x240 entry_SYSCALL_64_after_hwframe\u002B0x6f/0x77 As noted by Eric we can break the lock dependency chain avoid dumping ---truncated---", "published": "2024-04-04T09:15:07Z", "severity": "medium", "cvss": 5.5, "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "epss": 0.00173, "epssPercentile": 0.06748, "priority": "Routine", "priorityTier": 4, "exploited": false, "vendorExploited": false, "disclosed": false, "fixes": [ { "platform": "linux", "product": "linux", "release": "Debian 12.15 (bookworm)", "fixedVersion": "6.1.82-1", "fix": "DEBIAN-CVE-2024-26781", "url": "https://patchblox.com/security/fix/linux/debian-cve-2024-26781", "released": "2024-04-04T09:15:07Z" }, { "platform": "linux", "product": "linux", "release": "Debian 13.5 (trixie)", "fixedVersion": "6.7.9-1", "fix": "DEBIAN-CVE-2024-26781", "url": "https://patchblox.com/security/fix/linux/debian-cve-2024-26781", "released": "2024-04-04T09:15:07Z" }, { "platform": "linux", "product": "linux", "release": "Debian 14", "fixedVersion": "6.7.9-1", "fix": "DEBIAN-CVE-2024-26781", "url": "https://patchblox.com/security/fix/linux/debian-cve-2024-26781", "released": "2024-04-04T09:15:07Z" } ], "noFixYet": [], "dataAsOf": "2026-11-09T07:25:28Z", "attribution": { "text": "Data: Patchblox Patch Radar", "url": "https://patchblox.com/security/patch-radar", "terms": "https://patchblox.com/security/patch-radar/use-the-data" } }