# CVE-2024-50079: linux: In the Linux kernel, the following vulnerability has been resolved:  io_uring/sqpoll: ensure task state is TASK_RUNNI...

CVE-2024-50079 is fixed in linux on 1 platform, first by DEBIAN-CVE-2024-50079, released October 29, 2024. It is not reported as exploited. Patch Radar priority: Routine.

- Web page: https://patchblox.com/security/cve/CVE-2024-50079
- Priority: Routine
- CVSS: 5.5 (medium)
- EPSS: 0.0018
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Oct 29, 2024

## Description

In the Linux kernel, the following vulnerability has been resolved:  io_uring/sqpoll: ensure task state is TASK_RUNNING when running task_work  When the sqpoll is exiting and cancels pending work items, it may need to run task_work. If this happens from within io_uring_cancel_generic(), then it may be under waiting for the io_uring_task waitqueue. This results in the below splat from the scheduler, as the ring mutex may be attempted grabbed while in a TASK_INTERRUPTIBLE state.  Ensure that the task state is set appropriately for that, just like what is done for the other cases in io_run_task_work().  do not call blocking ops when !TASK_RUNNING; state=1 set at [<0000000029387fd2>] prepare_to_wait+0x88/0x2fc WARNING: CPU: 6 PID: 59939 at kernel/sched/core.c:8561 __might_sleep+0xf4/0x140 Modules linked in: CPU: 6 UID: 0 PID: 59939 Comm: iou-sqp-59938 Not tainted 6.12.0-rc3-00113-g8d020023b155 #7456 Hardware name: linux,dummy-virt (DT) pstate: 61400005 (nZCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--) pc : __might_sleep+0xf4/0x140 lr : __might_sleep+0xf4/0x140 sp : ffff80008c5e7830 x29: ffff80008c5e7830 x28: ffff0000d93088c0 x27: ffff60001c2d7230 x26: dfff800000000000 x25: ffff0000e16b9180 x24: ffff80008c5e7a50 x23: 1ffff000118bcf4a x22: ffff0000e16b9180 x21: ffff0000e16b9180 x20: 000000000000011b x19: ffff80008310fac0 x18: 1ffff000118bcd90 x17: 30303c5b20746120 x16: 74657320313d6574 x15: 0720072007200720 x14: 0720072007200720 x13: 0720072007200720 x12: ffff600036c64f0b x11: 1fffe00036c64f0a x10: ffff600036c64f0a x9 : dfff800000000000 x8 : 00009fffc939b0f6 x7 : ffff0001b6327853 x6 : 0000000000000001 x5 : ffff0001b6327850 x4 : ffff600036c64f0b x3 : ffff8000803c35bc x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff0000e16b9180 Call trace:  __might_sleep+0xf4/0x140  mutex_lock+0x84/0x124  io_handle_tw_list+0xf4/0x260  tctx_task_work_run+0x94/0x340  io_run_task_work+0x1ec/0x3c0  io_uring_cancel_generic+0x364/0x524  io_sq_thread+0x820/0x124c  ret_from_fork+0x10/0x20

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | linux Debian 13.5 (trixie) | 6.11.5-1 | [DEBIAN-CVE-2024-50079](https://patchblox.com/security/data/fix/linux/debian-cve-2024-50079.md) | Oct 29, 2024 |
| Linux | linux Debian 14 | 6.11.5-1 | [DEBIAN-CVE-2024-50079](https://patchblox.com/security/data/fix/linux/debian-cve-2024-50079.md) | Oct 29, 2024 |

---

Data as of 2026-11-08T19:12:23Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.