CVE-2024-44959 (GCVE-0-2024-44959)
Vulnerability from cvelistv5
Published
2024-09-04 18:35
Modified
2026-08-05 11:37
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
tracefs: Use generic inode RCU for synchronizing freeing
With structure layout randomization enabled for 'struct inode' we need to
avoid overlapping any of the RCU-used / initialized-only-once members,
e.g. i_lru or i_sb_list to not corrupt related list traversals when making
use of the rcu_head.
For an unlucky structure layout of 'struct inode' we may end up with the
following splat when running the ftrace selftests:
[<...>] list_del corruption, ffff888103ee2cb0->next (tracefs_inode_cache+0x0/0x4e0 [slab object]) is NULL (prev is tracefs_inode_cache+0x78/0x4e0 [slab object])
[<...>] ------------[ cut here ]------------
[<...>] kernel BUG at lib/list_debug.c:54!
[<...>] invalid opcode: 0000 [#1] PREEMPT SMP KASAN
[<...>] CPU: 3 PID: 2550 Comm: mount Tainted: G N 6.8.12-grsec+ #122 ed2f536ca62f28b087b90e3cc906a8d25b3ddc65
[<...>] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-2 04/01/2014
[<...>] RIP: 0010:[<ffffffff84656018>] __list_del_entry_valid_or_report+0x138/0x3e0
[<...>] Code: 48 b8 99 fb 65 f2 ff ff ff ff e9 03 5c d9 fc cc 48 b8 99 fb 65 f2 ff ff ff ff e9 33 5a d9 fc cc 48 b8 99 fb 65 f2 ff ff ff ff <0f> 0b 4c 89 e9 48 89 ea 48 89 ee 48 c7 c7 60 8f dd 89 31 c0 e8 2f
[<...>] RSP: 0018:fffffe80416afaf0 EFLAGS: 00010283
[<...>] RAX: 0000000000000098 RBX: ffff888103ee2cb0 RCX: 0000000000000000
[<...>] RDX: ffffffff84655fe8 RSI: ffffffff89dd8b60 RDI: 0000000000000001
[<...>] RBP: ffff888103ee2cb0 R08: 0000000000000001 R09: fffffbd0082d5f25
[<...>] R10: fffffe80416af92f R11: 0000000000000001 R12: fdf99c16731d9b6d
[<...>] R13: 0000000000000000 R14: ffff88819ad4b8b8 R15: 0000000000000000
[<...>] RBX: tracefs_inode_cache+0x0/0x4e0 [slab object]
[<...>] RDX: __list_del_entry_valid_or_report+0x108/0x3e0
[<...>] RSI: __func__.47+0x4340/0x4400
[<...>] RBP: tracefs_inode_cache+0x0/0x4e0 [slab object]
[<...>] RSP: process kstack fffffe80416afaf0+0x7af0/0x8000 [mount 2550 2550]
[<...>] R09: kasan shadow of process kstack fffffe80416af928+0x7928/0x8000 [mount 2550 2550]
[<...>] R10: process kstack fffffe80416af92f+0x792f/0x8000 [mount 2550 2550]
[<...>] R14: tracefs_inode_cache+0x78/0x4e0 [slab object]
[<...>] FS: 00006dcb380c1840(0000) GS:ffff8881e0600000(0000) knlGS:0000000000000000
[<...>] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[<...>] CR2: 000076ab72b30e84 CR3: 000000000b088004 CR4: 0000000000360ef0 shadow CR4: 0000000000360ef0
[<...>] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[<...>] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[<...>] ASID: 0003
[<...>] Stack:
[<...>] ffffffff818a2315 00000000f5c856ee ffffffff896f1840 ffff888103ee2cb0
[<...>] ffff88812b6b9750 0000000079d714b6 fffffbfff1e9280b ffffffff8f49405f
[<...>] 0000000000000001 0000000000000000 ffff888104457280 ffffffff8248b392
[<...>] Call Trace:
[<...>] <TASK>
[<...>] [<ffffffff818a2315>] ? lock_release+0x175/0x380 fffffe80416afaf0
[<...>] [<ffffffff8248b392>] list_lru_del+0x152/0x740 fffffe80416afb48
[<...>] [<ffffffff8248ba93>] list_lru_del_obj+0x113/0x280 fffffe80416afb88
[<...>] [<ffffffff8940fd19>] ? _atomic_dec_and_lock+0x119/0x200 fffffe80416afb90
[<...>] [<ffffffff8295b244>] iput_final+0x1c4/0x9a0 fffffe80416afbb8
[<...>] [<ffffffff8293a52b>] dentry_unlink_inode+0x44b/0xaa0 fffffe80416afbf8
[<...>] [<ffffffff8293fefc>] __dentry_kill+0x23c/0xf00 fffffe80416afc40
[<...>] [<ffffffff8953a85f>] ? __this_cpu_preempt_check+0x1f/0xa0 fffffe80416afc48
[<...>] [<ffffffff82949ce5>] ? shrink_dentry_list+0x1c5/0x760 fffffe80416afc70
[<...>] [<ffffffff82949b71>] ? shrink_dentry_list+0x51/0x760 fffffe80416afc78
[<...>] [<ffffffff82949da8>] shrink_dentry_list+0x288/0x760 fffffe80416afc80
[<...>] [<ffffffff8294ae75>] shrink_dcache_sb+0x155/0x420 fffffe80416afcc8
[<...>] [<ffffffff8953a7c3>] ? debug_smp_processor_id+0x23/0xa0 fffffe80416afce0
[<...>] [<ffffffff8294ad20>] ? do_one_tre
---truncated---
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-44959",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-10T17:39:53.968694Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-12T17:33:36.099Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/tracefs/inode.c",
"fs/tracefs/internal.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "726f4c241e17be75a9cf6870d80cd7479dc89e8f",
"status": "affected",
"version": "5f91fc82794d4a6e41cdcd02d00baa377d94ca78",
"versionType": "git"
},
{
"lessThan": "061da60716ce0cde99f62f31937b81e1c03acef6",
"status": "affected",
"version": "baa23a8d4360d981a49913841a726edede5cdd54",
"versionType": "git"
},
{
"lessThan": "0b6743bd60a56a701070b89fb80c327a44b7b3e2",
"status": "affected",
"version": "baa23a8d4360d981a49913841a726edede5cdd54",
"versionType": "git"
},
{
"status": "affected",
"version": "414fb08628143203d29ccd0264b5a83fb9523c03",
"versionType": "git"
},
{
"lessThan": "6.6.46",
"status": "affected",
"version": "6.6.31",
"versionType": "semver"
},
{
"lessThan": "6.9",
"status": "affected",
"version": "6.8.10",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/tracefs/inode.c",
"fs/tracefs/internal.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.9"
},
{
"lessThan": "6.9",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.46",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.10.*",
"status": "unaffected",
"version": "6.10.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.11",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.46",
"versionStartIncluding": "6.6.31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.10.5",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.11",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.8.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntracefs: Use generic inode RCU for synchronizing freeing\n\nWith structure layout randomization enabled for \u0027struct inode\u0027 we need to\navoid overlapping any of the RCU-used / initialized-only-once members,\ne.g. i_lru or i_sb_list to not corrupt related list traversals when making\nuse of the rcu_head.\n\nFor an unlucky structure layout of \u0027struct inode\u0027 we may end up with the\nfollowing splat when running the ftrace selftests:\n\n[\u003c...\u003e] list_del corruption, ffff888103ee2cb0-\u003enext (tracefs_inode_cache+0x0/0x4e0 [slab object]) is NULL (prev is tracefs_inode_cache+0x78/0x4e0 [slab object])\n[\u003c...\u003e] ------------[ cut here ]------------\n[\u003c...\u003e] kernel BUG at lib/list_debug.c:54!\n[\u003c...\u003e] invalid opcode: 0000 [#1] PREEMPT SMP KASAN\n[\u003c...\u003e] CPU: 3 PID: 2550 Comm: mount Tainted: G N 6.8.12-grsec+ #122 ed2f536ca62f28b087b90e3cc906a8d25b3ddc65\n[\u003c...\u003e] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-2 04/01/2014\n[\u003c...\u003e] RIP: 0010:[\u003cffffffff84656018\u003e] __list_del_entry_valid_or_report+0x138/0x3e0\n[\u003c...\u003e] Code: 48 b8 99 fb 65 f2 ff ff ff ff e9 03 5c d9 fc cc 48 b8 99 fb 65 f2 ff ff ff ff e9 33 5a d9 fc cc 48 b8 99 fb 65 f2 ff ff ff ff \u003c0f\u003e 0b 4c 89 e9 48 89 ea 48 89 ee 48 c7 c7 60 8f dd 89 31 c0 e8 2f\n[\u003c...\u003e] RSP: 0018:fffffe80416afaf0 EFLAGS: 00010283\n[\u003c...\u003e] RAX: 0000000000000098 RBX: ffff888103ee2cb0 RCX: 0000000000000000\n[\u003c...\u003e] RDX: ffffffff84655fe8 RSI: ffffffff89dd8b60 RDI: 0000000000000001\n[\u003c...\u003e] RBP: ffff888103ee2cb0 R08: 0000000000000001 R09: fffffbd0082d5f25\n[\u003c...\u003e] R10: fffffe80416af92f R11: 0000000000000001 R12: fdf99c16731d9b6d\n[\u003c...\u003e] R13: 0000000000000000 R14: ffff88819ad4b8b8 R15: 0000000000000000\n[\u003c...\u003e] RBX: tracefs_inode_cache+0x0/0x4e0 [slab object]\n[\u003c...\u003e] RDX: __list_del_entry_valid_or_report+0x108/0x3e0\n[\u003c...\u003e] RSI: __func__.47+0x4340/0x4400\n[\u003c...\u003e] RBP: tracefs_inode_cache+0x0/0x4e0 [slab object]\n[\u003c...\u003e] RSP: process kstack fffffe80416afaf0+0x7af0/0x8000 [mount 2550 2550]\n[\u003c...\u003e] R09: kasan shadow of process kstack fffffe80416af928+0x7928/0x8000 [mount 2550 2550]\n[\u003c...\u003e] R10: process kstack fffffe80416af92f+0x792f/0x8000 [mount 2550 2550]\n[\u003c...\u003e] R14: tracefs_inode_cache+0x78/0x4e0 [slab object]\n[\u003c...\u003e] FS: 00006dcb380c1840(0000) GS:ffff8881e0600000(0000) knlGS:0000000000000000\n[\u003c...\u003e] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[\u003c...\u003e] CR2: 000076ab72b30e84 CR3: 000000000b088004 CR4: 0000000000360ef0 shadow CR4: 0000000000360ef0\n[\u003c...\u003e] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n[\u003c...\u003e] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n[\u003c...\u003e] ASID: 0003\n[\u003c...\u003e] Stack:\n[\u003c...\u003e] ffffffff818a2315 00000000f5c856ee ffffffff896f1840 ffff888103ee2cb0\n[\u003c...\u003e] ffff88812b6b9750 0000000079d714b6 fffffbfff1e9280b ffffffff8f49405f\n[\u003c...\u003e] 0000000000000001 0000000000000000 ffff888104457280 ffffffff8248b392\n[\u003c...\u003e] Call Trace:\n[\u003c...\u003e] \u003cTASK\u003e\n[\u003c...\u003e] [\u003cffffffff818a2315\u003e] ? lock_release+0x175/0x380 fffffe80416afaf0\n[\u003c...\u003e] [\u003cffffffff8248b392\u003e] list_lru_del+0x152/0x740 fffffe80416afb48\n[\u003c...\u003e] [\u003cffffffff8248ba93\u003e] list_lru_del_obj+0x113/0x280 fffffe80416afb88\n[\u003c...\u003e] [\u003cffffffff8940fd19\u003e] ? _atomic_dec_and_lock+0x119/0x200 fffffe80416afb90\n[\u003c...\u003e] [\u003cffffffff8295b244\u003e] iput_final+0x1c4/0x9a0 fffffe80416afbb8\n[\u003c...\u003e] [\u003cffffffff8293a52b\u003e] dentry_unlink_inode+0x44b/0xaa0 fffffe80416afbf8\n[\u003c...\u003e] [\u003cffffffff8293fefc\u003e] __dentry_kill+0x23c/0xf00 fffffe80416afc40\n[\u003c...\u003e] [\u003cffffffff8953a85f\u003e] ? __this_cpu_preempt_check+0x1f/0xa0 fffffe80416afc48\n[\u003c...\u003e] [\u003cffffffff82949ce5\u003e] ? shrink_dentry_list+0x1c5/0x760 fffffe80416afc70\n[\u003c...\u003e] [\u003cffffffff82949b71\u003e] ? shrink_dentry_list+0x51/0x760 fffffe80416afc78\n[\u003c...\u003e] [\u003cffffffff82949da8\u003e] shrink_dentry_list+0x288/0x760 fffffe80416afc80\n[\u003c...\u003e] [\u003cffffffff8294ae75\u003e] shrink_dcache_sb+0x155/0x420 fffffe80416afcc8\n[\u003c...\u003e] [\u003cffffffff8953a7c3\u003e] ? debug_smp_processor_id+0x23/0xa0 fffffe80416afce0\n[\u003c...\u003e] [\u003cffffffff8294ad20\u003e] ? do_one_tre\n---truncated---"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - tracefs is a local pseudo-filesystem; the bug is driven by ordinary local file operations (lookup/open/close in /sys/kernel/tracing) and the mount/remount syscall. There is no network or adjacent-network path into `tracefs_free_inode()` or `tracefs_apply_options()`.\nAC:L - On an affected build the attacker triggers it at will and deterministically \u2014 every tracefs inode free scribbles the rcu_head over the once-initialized list heads, and reuse is guaranteed because `tracefs_inode_cache` is a dedicated slab cache, so simply cycling lookups plus dentry reclaim reproduces the corruption with no race to win. The remount variant is likewise fully attacker-driven on both sides (one thread in `shrink_dcache_sb()` freeing inodes, another in `tracefs_apply_options()` iterating the RCU list).\nPR:L - No capability is required to allocate and free tracefs inodes \u2014 plain lookups under the tracefs mount suffice \u2014 and tracefs is commonly delegated to an unprivileged tracing group through the very `uid=`/`gid=`/`mode=` options this code exists to support (Android/ChromeOS/perf-tooling deployments). An ordinary account in that group can drive the inode churn that corrupts `i_lru`/`i_sb_list`.\nUI:N - The attacker performs all steps itself with its own file operations; no victim has to open a file, mount anything, or take any action.\nS:U - The corruption is confined to kernel slab objects and kernel list structures managed by the same security authority; there is no VM, IOMMU, or sandbox boundary crossed.\nC:H - Corrupted `i_lru`/`i_sb_list` heads on a reused inode turn subsequent `list_lru_del()`/`evict_inodes()` traversals into dereferences of stale or attacker-groomed pointers, a use-after-free-class primitive that can be steered into arbitrary kernel memory disclosure. The overlapping `rcu_head.next` corruption likewise makes `rcu_do_batch()` walk into an attacker-influenced address.\nI:H - `__list_del()` on the corrupted heads performs `prev-\u003enext = next; next-\u003eprev = prev`, giving an unlink write primitive against heap layout the attacker grooms via the dedicated `tracefs_inode_cache`. The remount path is worse still: the attacker-chosen `gid=` value overwrites the low half of a queued RCU callback\u0027s `func` pointer, yielding direct control-flow hijack in softirq context.\nA:H - The reported failure is a hard kernel BUG in `__list_del_entry_valid_or_report()` (`lib/list_debug.c:54`) reached from `iput_final()`, i.e. an immediate panic/oops; without `DEBUG_LIST` the silent list corruption still leads to kernel crashes."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T11:37:19.145Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/726f4c241e17be75a9cf6870d80cd7479dc89e8f"
},
{
"url": "https://git.kernel.org/stable/c/061da60716ce0cde99f62f31937b81e1c03acef6"
},
{
"url": "https://git.kernel.org/stable/c/0b6743bd60a56a701070b89fb80c327a44b7b3e2"
}
],
"title": "tracefs: Use generic inode RCU for synchronizing freeing",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2024-44959",
"datePublished": "2024-09-04T18:35:57.464Z",
"dateReserved": "2024-08-21T05:34:56.666Z",
"dateUpdated": "2026-08-05T11:37:19.145Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-44959\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-10T17:39:53.968694Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-11T12:42:27.597Z\"}}], \"cna\": {\"title\": \"tracefs: Use generic inode RCU for synchronizing freeing\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5f91fc82794d4a6e41cdcd02d00baa377d94ca78\", \"lessThan\": \"726f4c241e17be75a9cf6870d80cd7479dc89e8f\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"baa23a8d4360d981a49913841a726edede5cdd54\", \"lessThan\": \"061da60716ce0cde99f62f31937b81e1c03acef6\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"baa23a8d4360d981a49913841a726edede5cdd54\", \"lessThan\": \"0b6743bd60a56a701070b89fb80c327a44b7b3e2\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"414fb08628143203d29ccd0264b5a83fb9523c03\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"6.6.31\", \"lessThan\": \"6.6.46\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"6.8.10\", \"lessThan\": \"6.9\", \"versionType\": \"semver\"}], \"programFiles\": [\"fs/tracefs/inode.c\", \"fs/tracefs/internal.h\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.9\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.9\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.6.46\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.10.5\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.10.*\"}, {\"status\": \"unaffected\", \"version\": \"6.11\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"fs/tracefs/inode.c\", \"fs/tracefs/internal.h\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/726f4c241e17be75a9cf6870d80cd7479dc89e8f\"}, {\"url\": \"https://git.kernel.org/stable/c/061da60716ce0cde99f62f31937b81e1c03acef6\"}, {\"url\": \"https://git.kernel.org/stable/c/0b6743bd60a56a701070b89fb80c327a44b7b3e2\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ntracefs: Use generic inode RCU for synchronizing freeing\\n\\nWith structure layout randomization enabled for \u0027struct inode\u0027 we need to\\navoid overlapping any of the RCU-used / initialized-only-once members,\\ne.g. i_lru or i_sb_list to not corrupt related list traversals when making\\nuse of the rcu_head.\\n\\nFor an unlucky structure layout of \u0027struct inode\u0027 we may end up with the\\nfollowing splat when running the ftrace selftests:\\n\\n[\u003c...\u003e] list_del corruption, ffff888103ee2cb0-\u003enext (tracefs_inode_cache+0x0/0x4e0 [slab object]) is NULL (prev is tracefs_inode_cache+0x78/0x4e0 [slab object])\\n[\u003c...\u003e] ------------[ cut here ]------------\\n[\u003c...\u003e] kernel BUG at lib/list_debug.c:54!\\n[\u003c...\u003e] invalid opcode: 0000 [#1] PREEMPT SMP KASAN\\n[\u003c...\u003e] CPU: 3 PID: 2550 Comm: mount Tainted: G N 6.8.12-grsec+ #122 ed2f536ca62f28b087b90e3cc906a8d25b3ddc65\\n[\u003c...\u003e] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-2 04/01/2014\\n[\u003c...\u003e] RIP: 0010:[\u003cffffffff84656018\u003e] __list_del_entry_valid_or_report+0x138/0x3e0\\n[\u003c...\u003e] Code: 48 b8 99 fb 65 f2 ff ff ff ff e9 03 5c d9 fc cc 48 b8 99 fb 65 f2 ff ff ff ff e9 33 5a d9 fc cc 48 b8 99 fb 65 f2 ff ff ff ff \u003c0f\u003e 0b 4c 89 e9 48 89 ea 48 89 ee 48 c7 c7 60 8f dd 89 31 c0 e8 2f\\n[\u003c...\u003e] RSP: 0018:fffffe80416afaf0 EFLAGS: 00010283\\n[\u003c...\u003e] RAX: 0000000000000098 RBX: ffff888103ee2cb0 RCX: 0000000000000000\\n[\u003c...\u003e] RDX: ffffffff84655fe8 RSI: ffffffff89dd8b60 RDI: 0000000000000001\\n[\u003c...\u003e] RBP: ffff888103ee2cb0 R08: 0000000000000001 R09: fffffbd0082d5f25\\n[\u003c...\u003e] R10: fffffe80416af92f R11: 0000000000000001 R12: fdf99c16731d9b6d\\n[\u003c...\u003e] R13: 0000000000000000 R14: ffff88819ad4b8b8 R15: 0000000000000000\\n[\u003c...\u003e] RBX: tracefs_inode_cache+0x0/0x4e0 [slab object]\\n[\u003c...\u003e] RDX: __list_del_entry_valid_or_report+0x108/0x3e0\\n[\u003c...\u003e] RSI: __func__.47+0x4340/0x4400\\n[\u003c...\u003e] RBP: tracefs_inode_cache+0x0/0x4e0 [slab object]\\n[\u003c...\u003e] RSP: process kstack fffffe80416afaf0+0x7af0/0x8000 [mount 2550 2550]\\n[\u003c...\u003e] R09: kasan shadow of process kstack fffffe80416af928+0x7928/0x8000 [mount 2550 2550]\\n[\u003c...\u003e] R10: process kstack fffffe80416af92f+0x792f/0x8000 [mount 2550 2550]\\n[\u003c...\u003e] R14: tracefs_inode_cache+0x78/0x4e0 [slab object]\\n[\u003c...\u003e] FS: 00006dcb380c1840(0000) GS:ffff8881e0600000(0000) knlGS:0000000000000000\\n[\u003c...\u003e] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\\n[\u003c...\u003e] CR2: 000076ab72b30e84 CR3: 000000000b088004 CR4: 0000000000360ef0 shadow CR4: 0000000000360ef0\\n[\u003c...\u003e] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\\n[\u003c...\u003e] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\\n[\u003c...\u003e] ASID: 0003\\n[\u003c...\u003e] Stack:\\n[\u003c...\u003e] ffffffff818a2315 00000000f5c856ee ffffffff896f1840 ffff888103ee2cb0\\n[\u003c...\u003e] ffff88812b6b9750 0000000079d714b6 fffffbfff1e9280b ffffffff8f49405f\\n[\u003c...\u003e] 0000000000000001 0000000000000000 ffff888104457280 ffffffff8248b392\\n[\u003c...\u003e] Call Trace:\\n[\u003c...\u003e] \u003cTASK\u003e\\n[\u003c...\u003e] [\u003cffffffff818a2315\u003e] ? lock_release+0x175/0x380 fffffe80416afaf0\\n[\u003c...\u003e] [\u003cffffffff8248b392\u003e] list_lru_del+0x152/0x740 fffffe80416afb48\\n[\u003c...\u003e] [\u003cffffffff8248ba93\u003e] list_lru_del_obj+0x113/0x280 fffffe80416afb88\\n[\u003c...\u003e] [\u003cffffffff8940fd19\u003e] ? _atomic_dec_and_lock+0x119/0x200 fffffe80416afb90\\n[\u003c...\u003e] [\u003cffffffff8295b244\u003e] iput_final+0x1c4/0x9a0 fffffe80416afbb8\\n[\u003c...\u003e] [\u003cffffffff8293a52b\u003e] dentry_unlink_inode+0x44b/0xaa0 fffffe80416afbf8\\n[\u003c...\u003e] [\u003cffffffff8293fefc\u003e] __dentry_kill+0x23c/0xf00 fffffe80416afc40\\n[\u003c...\u003e] [\u003cffffffff8953a85f\u003e] ? __this_cpu_preempt_check+0x1f/0xa0 fffffe80416afc48\\n[\u003c...\u003e] [\u003cffffffff82949ce5\u003e] ? shrink_dentry_list+0x1c5/0x760 fffffe80416afc70\\n[\u003c...\u003e] [\u003cffffffff82949b71\u003e] ? shrink_dentry_list+0x51/0x760 fffffe80416afc78\\n[\u003c...\u003e] [\u003cffffffff82949da8\u003e] shrink_dentry_list+0x288/0x760 fffffe80416afc80\\n[\u003c...\u003e] [\u003cffffffff8294ae75\u003e] shrink_dcache_sb+0x155/0x420 fffffe80416afcc8\\n[\u003c...\u003e] [\u003cffffffff8953a7c3\u003e] ? debug_smp_processor_id+0x23/0xa0 fffffe80416afce0\\n[\u003c...\u003e] [\u003cffffffff8294ad20\u003e] ? do_one_tre\\n---truncated---\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.46\", \"versionStartIncluding\": \"6.6.31\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.10.5\", \"versionStartIncluding\": \"6.9\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.11\", \"versionStartIncluding\": \"6.9\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"6.8.10\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-05-23T15:53:14.532Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2024-44959\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-05-23T15:53:14.532Z\", \"dateReserved\": \"2024-08-21T05:34:56.666Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-09-04T18:35:57.464Z\", \"assignerShortName\": \"Linux\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…