CVE-2024-57875

block: RCU protect disk->conv_zones_bitmap

MEDIUM
5.5
CVSS Score
Published: January 11, 2025 at 02:49 PM UTC
Updated: October 15, 2026 at 10:18 PM UTC
1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Severity
MEDIUM5.5
Exploit prediction
EPSS 0.2%
SSVC
No known exploit

Description

In the Linux kernel, the following vulnerability has been resolved: block: RCU protect disk->conv_zones_bitmap Ensure that a disk revalidation changing the conventional zones bitmap of a disk does not cause invalid memory references when using the disk_zone_is_conv() helper by RCU protecting the disk->conv_zones_bitmap pointer. disk_zone_is_conv() is modified to operate under the RCU read lock and the function disk_set_conv_zones_bitmap() is added to update a disk conv_zones_bitmap pointer using rcu_replace_pointer() with the disk zone_wplugs_lock spinlock held. disk_free_zone_resources() is modified to call disk_update_zone_resources() with a NULL bitmap pointer to free the disk conv_zones_bitmap. disk_set_conv_zones_bitmap() is also used in disk_update_zone_resources() to set the new (revalidated) bitmap and free the old one.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

v < 6.12.56.10dd291d77cc90eb6a86e9860ba8e6e38eebd57d12
Vendor states this is fixed in 493326c4f10cc71a42c27fdc97ce112182ee4cbc (fixed)
Vendor states this is fixed in d7cb6d7414ea1b33536fa6d11805cb8dceec1f97 (fixed)
Vendor states this is fixed in 6.10 (unaffected)
Vendor states this is fixed in 6.12.5 (unaffected)
Vendor states this is fixed in 6.13 (unaffected)

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

References (2)

Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/493326c4f10cc71a42c27fdc97ce112182ee4cbc
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/d7cb6d7414ea1b33536fa6d11805cb8dceec1f97

SSVC — Action Prioritization

SSVCNo known exploitNot automatableTotal impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

Attack Vector
LOCAL
Complexity
LOW
Privileges
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
NONE
Integrity
NONE
Availability
HIGH
Vector?

Quick Info

StatusMODIFIED
CWE
CWE-416NVD-CWE-noinfo

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Free plan, no card