CVE-2024-50280

dm cache: fix flushing uninitialized delayed_work on cache_ctr error

HIGH

7.8

CVSS Score

Published: November 19, 2024 at 01:30 AM UTC

Updated: June 17, 2026 at 08:04 AM UTC

1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH7.8

Exploit prediction

EPSS 0.3%

SSVC

No known exploit

Description

In the Linux kernel, the following vulnerability has been resolved: dm cache: fix flushing uninitialized delayed_work on cache_ctr error An unexpected WARN_ON from flush_work() may occur when cache creation fails, caused by destroying the uninitialized delayed_work waker in the error path of cache_create(). For example, the warning appears on the superblock checksum error. Reproduce steps: dmsetup create cmeta --table "0 8192 linear /dev/sdc 0" dmsetup create cdata --table "0 65536 linear /dev/sdc 8192" dmsetup create corig --table "0 524288 linear /dev/sdc 262144" dd if=/dev/urandom of=/dev/mapper/cmeta bs=4k count=1 oflag=direct dmsetup create cache --table "0 524288 cache /dev/mapper/cmeta \ /dev/mapper/cdata /dev/mapper/corig 128 2 metadata2 writethrough smq 0" Kernel logs: (snip) WARNING: CPU: 0 PID: 84 at kernel/workqueue.c:4178 __flush_work+0x5d4/0x890 Fix by pulling out the cancel_delayed_work_sync() from the constructor's error path. This patch doesn't affect the use-after-free fix for concurrent dm_resume and dm_destroy (commit 6a459d8edbdb ("dm cache: Fix UAF in destroy()")) as cache_dtr is not changed.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Linux Kernel · Linux

95%

v ≥ 4.14.303v ≥ 4.19.270v ≥ 4.9.337v ≥ 5.4.229v ≥ 6.0.184.14.303 ≤ v < 4.154.19.270 ≤ v < 4.204.9.337 ≤ v < 4.105.10.163 ≤ v < 5.10.2375.10.163 ≤ v < 5.115.15.87 ≤ v < 5.15.1815.15.87 ≤ v < 5.165.4.229 ≤ v < 5.56.0.18 ≤ v < 6.16.1.4 ≤ v < 6.1.1176.2 ≤ v < 6.11.86.2 ≤ v < 6.126.2 ≤ v < 6.6.616.7 ≤ v < 6.11.82b17026685a270b2beaf1cdd9857fcedd3505c7e2f097dfac7579fd84ff98eb1d3acd41d53a485f334cbc8d3b47a56acd89453c29632a9c117de9d4.14.303 4.19.270 4.9.3374d20032dd90664de09f2902a7ea49ae2f77717465.10.163 5.15.87 5.4.229 6.0.18 6.1.4 6.12 rc1 6.12 rc2 6.12 rc3 6.12 rc4 6.12 rc5 6.12 rc66a3e412c2ab131c54945327a7676b006f000a2096a459d8edbdbe7b24db42a5a9f21e6aa9e00c2aa6ac4f36910764cb510bafc4c3768544f86ca48ca993406104d2b28fe470126a062ad37a1e21e792ed2a0b298ebf83ab6236f66788a3541e91ce75a70

Vendor states this is fixed in 135496c208ba26fd68cdef10b64ed7a91ac9a7ff (fixed)

Vendor states this is fixed in 40fac0271c7aedf60d81ed8214e80851e5b26312 (fixed)

Vendor states this is fixed in 5a754d3c771280f2d06bf8ab716d6a0d36ca256e (fixed)

Vendor states this is fixed in 8cc12dab635333c4ea28e72d7b947be7d0543c2c (fixed)

Vendor states this is fixed in aee3ecda73ce13af7c3e556383342b57e6bd0718 (fixed)

Vendor states this is fixed in d154b333a5667b6c1b213a11a41ad7aaccd10c3d (fixed)

Affected range stops below 4.10, so it looks safe — our inference, not a vendor statement

Affected range stops below 4.15, so it looks safe — our inference, not a vendor statement

Affected range stops below 4.20, so it looks safe — our inference, not a vendor statement

Vendor states this is fixed in 5.10.237 (unaffected)

Affected range stops below 5.11, so it looks safe — our inference, not a vendor statement

Vendor states this is fixed in 5.15.181 (unaffected)

Affected range stops below 5.16, so it looks safe — our inference, not a vendor statement

Affected range stops below 5.5, so it looks safe — our inference, not a vendor statement

Affected range stops below 6.1, so it looks safe — our inference, not a vendor statement

Vendor states this is fixed in 6.1.117 (unaffected)

Vendor states this is fixed in 6.11.8 (unaffected)

Vendor states this is fixed in 6.12 (unaffected)

Vendor states this is fixed in 6.2 (unaffected)

Vendor states this is fixed in 6.6.61 (unaffected)

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references