CVE-2024-50304

ipv4: ip_tunnel: Fix suspicious RCU usage warning in ip_tunnel_find()

MEDIUM
5.5
CVSS Score
Published: November 19, 2024 at 05:19 PM UTC
Updated: June 17, 2026 at 08:04 AM UTC
1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Severity
MEDIUM5.5
Exploit prediction
EPSS 0.2%

Description

In the Linux kernel, the following vulnerability has been resolved: ipv4: ip_tunnel: Fix suspicious RCU usage warning in ip_tunnel_find() The per-netns IP tunnel hash table is protected by the RTNL mutex and ip_tunnel_find() is only called from the control path where the mutex is taken. Add a lockdep expression to hlist_for_each_entry_rcu() in ip_tunnel_find() in order to validate that the mutex is held and to silence the suspicious RCU usage warning [1]. [1] WARNING: suspicious RCU usage 6.12.0-rc3-custom-gd95d9a31aceb #139 Not tainted ----------------------------- net/ipv4/ip_tunnel.c:221 RCU-list traversed in non-reader section!! other info that might help us debug this: rcu_scheduler_active = 2, debug_locks = 1 1 lock held by ip/362: #0: ffffffff86fc7cb0 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x377/0xf60 stack backtrace: CPU: 12 UID: 0 PID: 362 Comm: ip Not tainted 6.12.0-rc3-custom-gd95d9a31aceb #139 Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 Call Trace: <TASK> dump_stack_lvl+0xba/0x110 lockdep_rcu_suspicious.cold+0x4f/0xd6 ip_tunnel_find+0x435/0x4d0 ip_tunnel_newlink+0x517/0x7a0 ipgre_newlink+0x14c/0x170 __rtnl_newlink+0x1173/0x19c0 rtnl_newlink+0x6c/0xa0 rtnetlink_rcv_msg+0x3cc/0xf60 netlink_rcv_skb+0x171/0x450 netlink_unicast+0x539/0x7f0 netlink_sendmsg+0x8c1/0xd80 ____sys_sendmsg+0x8f9/0xc20 ___sys_sendmsg+0x197/0x1e0 __sys_sendmsg+0x122/0x1f0 do_syscall_64+0xbb/0x1d0 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

3.10 ≤ v < 5.10.2343.10 ≤ v < 5.15.1783.10 ≤ v < 6.1.1283.10 ≤ v < 6.11.73.10 ≤ v < 6.123.10 ≤ v < 6.6.753.10.12 ≤ v < 6.11.76.12 rc16.12 rc26.12 rc36.12 rc46.12 rc56.12 rc6c54419321455631079c7d6e60bc732dd0c5914c5
Vendor states this is fixed in 31bd7378c6fe100a8af0e996ea0b5dafd3579df6 (fixed)
Vendor states this is fixed in 6ac5dfa575136da8dd8a9e7c1437c41f3a593993 (fixed)
Vendor states this is fixed in 90e0569dd3d32f4f4d2ca691d3fa5a8a14a13c12 (fixed)
Vendor states this is fixed in ce11424026cbf87d5861b09e5e33565ff7f2ec8d (fixed)
Vendor states this is fixed in e0500e4373cd3d5eace1f1712444ab830b82c114 (fixed)
Vendor states this is fixed in f20fe2cfe06ca1b008b09da4f2b4e0c5547ccef6 (fixed)
Vendor states this is fixed in 3.10 (unaffected)
Vendor states this is fixed in 5.10.234 (unaffected)
Vendor states this is fixed in 5.15.178 (unaffected)
Vendor states this is fixed in 6.1.128 (unaffected)
Vendor states this is fixed in 6.11.7 (unaffected)
Vendor states this is fixed in 6.12 (unaffected)
Vendor states this is fixed in 6.6.75 (unaffected)

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

References (8)

CVSS

Attack Vector
LOCAL
Complexity
LOW
Privileges
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
NONE
Integrity
NONE
Availability
HIGH
Vector?

Quick Info

StatusMODIFIED
CWE
NVD-CWE-noinfo

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Free plan, no card