CVE-2024-26757— md: Don't ignore read-only array in md_check_recovery()
Quick assessment
Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于只读数组会导致注册错误。
Possible ATT&CK Techniques 1 AI
T1496 · Resource HijackingAffected Version Matrix 6
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Linux | Linux | ecbfb9f118bce49f571675929160e4ecef91cc8a< 2ea169c5a0b1134d573d07fc27a16f327ad0e7d3 |
affected |
ecbfb9f118bce49f571675929160e4ecef91cc8a< 55a48ad2db64737f7ffc0407634218cc6e4c513b |
affected | ||
4.8 |
affected | ||
< 4.8 |
unaffected | ||
6.7.7≤ 6.7.* |
unaffected | ||
6.8≤ * |
unaffected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2024-26757
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
md: Don't ignore read-only array in md_check_recovery()
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved:
md: Don't ignore read-only array in md_check_recovery()
Usually if the array is not read-write, md_check_recovery() won't
register new sync_thread in the first place. And if the array is
read-write and sync_thread is registered, md_set_readonly() will
unregister sync_thread before setting the array read-only. md/raid
follow this behavior hence there is no problem.
After commit f52f5c71f3d4 ("md: fix stopping sync thread"), following
hang can be triggered by test shell/integrity-caching.sh:
1) array is read-only. dm-raid update super block:
rs_update_sbs
ro = mddev->ro
mddev->ro = 0
-> set array read-write
md_update_sb
2) register new sync thread concurrently.
3) dm-raid set array back to read-only:
rs_update_sbs
mddev->ro = ro
4) stop the array:
raid_dtr
md_stop
stop_sync_thread
set_bit(MD_RECOVERY_INTR, &mddev->recovery);
md_wakeup_thread_directly(mddev->sync_thread);
wait_event(..., !test_bit(MD_RECOVERY_RUNNING, &mddev->recovery))
5) sync thread done:
md_do_sync
set_bit(MD_RECOVERY_DONE, &mddev->recovery);
md_wakeup_thread(mddev->thread);
6) daemon thread can't unregister sync thread:
md_check_recovery
if (!md_is_rdwr(mddev) &&
!test_bit(MD_RECOVERY_NEEDED, &mddev->recovery))
return;
-> -> MD_RECOVERY_RUNNING can't be cleared, hence step 4 hang;
The root cause is that dm-raid manipulate 'mddev->ro' by itself,
however, dm-raid really should stop sync thread before setting the
array read-only. Unfortunately, I need to read more code before I
can refacter the handler of 'mddev->ro' in dm-raid, hence let's fix
the problem the easy way for now to prevent dm-raid regression.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于只读数组会导致注册错误。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2024-26757
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2024-26757
请登录查看更多情报信息。
Other References for CVE-2024-26757 (2)
Same Patch Batch · Linux · 2024-04-03 · 94 CVEs total
| CVE-2024-26760 | 9.8 CRITICAL | scsi: target: pscsi: Fix bio_put() for error case |
| CVE-2024-26689 | 8.8 HIGH | ceph: prevent use-after-free in encode_cap_msg() |
| CVE-2024-26779 | 8.8 HIGH | wifi: mac80211: fix race condition on enabling fast-xmit |
| CVE-2024-26692 | 8.3 HIGH | smb: Fix regression in writes when non-standard maximum write size negotiated |
| CVE-2024-26736 | 8.1 HIGH | afs: Increase buffer size in afs_update_volume_status() |
| CVE-2024-26737 | 7.8 HIGH | bpf: Fix racing between bpf_timer_cancel_and_free and bpf_timer_cancel |
| CVE-2024-26739 | 7.8 HIGH | net/sched: act_mirred: don't override retval if we already lost the skb |
| CVE-2023-52637 | 7.8 HIGH | can: j1939: Fix UAF in j1939_sk_match_filter during setsockopt(SO_J1939_FILTER) |
| CVE-2024-26728 | 7.8 HIGH | drm/amd/display: fix null-pointer dereference on edid reading |
| CVE-2024-26748 | 7.8 HIGH | usb: cdns3: fix memory double free when handle zero packet |
| CVE-2024-26712 | 7.8 HIGH | powerpc/kasan: Fix addr error caused by page alignment |
| CVE-2024-26718 | 7.8 HIGH | dm-crypt, dm-verity: disable tasklets |
| CVE-2024-26759 | 7.8 HIGH | mm/swap: fix race when skipping swapcache |
| CVE-2024-26762 | 7.8 HIGH | cxl/pci: Skip to handle RAS errors if CXL.mem device is detached |
| CVE-2024-26706 | 7.8 HIGH | parisc: Fix random data corruption from exception handler |
| CVE-2024-26704 | 7.8 HIGH | ext4: fix double-free of blocks due to wrong extents moved_len |
| CVE-2024-26766 | 7.8 HIGH | IB/hfi1: Fix sdma.h tx->num_descs off-by-one error |
| CVE-2024-26773 | 7.8 HIGH | ext4: avoid allocating blocks from corrupted group in ext4_mb_try_best_found() |
| CVE-2024-26697 | 7.8 HIGH | nilfs2: fix data corruption in dsync block recovery for small block sizes |
| CVE-2024-26699 | 7.8 HIGH | drm/amd/display: Fix array-index-out-of-bounds in dcn35_clkmgr |
Showing top 20 of 94 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Linux
-
CVE-2026-98384
bpf: Fix out-of-bounds read of sk_protocol in bpf_sock_destr -
CVE-2026-98383
bpf: Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL -
CVE-2026-98382
bpf: Reject dev-bound-only programs on other devices -
CVE-2026-98381
veth: manage XDP program pointers during channel resize -
CVE-2026-98380
net/sched: reject IDR error pointers when deleting actions
Same vendor: Linux
-
CVE-2026-98384
bpf: Fix out-of-bounds read of sk_protocol in bpf_sock_destr -
CVE-2026-98383
bpf: Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL -
CVE-2026-98382
bpf: Reject dev-bound-only programs on other devices -
CVE-2026-98381
veth: manage XDP program pointers during channel resize -
CVE-2026-98380
net/sched: reject IDR error pointers when deleting actions
V. Comments for CVE-2024-26757
No comments yet