NetSight
IP …
critical9.8

CVE-2024-49855

In the Linux kernel, the following vulnerability has been resolved: nbd: fix race between timeout and normal completion If request timetout is handled by nbd_r…

Impact

In the Linux kernel, the following vulnerability has been resolved: nbd: fix race between timeout and normal completion If request timetout is handled by nbd_requeue_cmd(), normal completion has to be stopped for avoiding to complete this requeued request, other use-after-free can be triggered. Fix the race by clearing NBD_CMD_INFLIGHT in nbd_requeue_cmd(), meantime make sure that cmd->lock is grabbed for clearing the flag and the requeue.

Affected products

VendorProductAffected versions
LinuxLinux Kernel
from 5.18.4 before 5.19
from 5.19 before 6.1.113
from 6.2 before 6.6.54
from 6.7 before 6.10.13
from 6.11 before 6.11.2
Version 5.17.15

Weakness classification

CWE-416

References