CVE-2024-35815

fs/aio: Check IOCB_AIO_RW before the struct aio_kiocb conversion

State: Published
Severity: Not scored
Published: May 17, 2024
Updated: Oct 15, 2026
Reserved: May 17, 2024

Description

In the Linux kernel, the following vulnerability has been resolved:

fs/aio: Check IOCB_AIO_RW before the struct aio_kiocb conversion

The first kiocb_set_cancel_fn() argument may point at a struct kiocb that is not embedded inside struct aio_kiocb. With the current code, depending on the compiler, the req->ki_ctx read happens either before the IOCB_AIO_RW test or after that test. Move the req->ki_ctx read such that it is guaranteed that the IOCB_AIO_RW test happens first.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	337b543e274fe7a8f47df3c8293cc6686ffa620f to before 10ca82aff58434e122c7c757cf0497c335f993f3Affected b4eea7a05ee0ab5ab0514421e6ba8c5d249cf942 to before 396dbbc18963648e9d1a4edbb55cfe08fa374d50Affected ea1cd64d59f22d6d13f367d62ec6e27b9344695f to before 94eb0293703ced580f05dfbe5a57da5931e9aee2Affected d7b6fa97ec894edd02f64b83e5e72e1aa352f353 to before a71cba07783abc76b547568b6452cd1dd9981410Affected 18f614369def2a11a52f569fe0f910b199d13487 to before 18d5fc3c16cc317bd0e5f5dabe0660df415cadb7Affected e7e23fc5d5fe422827c9a43ecb579448f73876c7 to before c01ed748847fe8b810d86efc229b9e6c7fafa01eAffected 1dc7d74fe456944a9b1c57bd776280249f441ac6 to before 5c43d0041e3a05c6c41c318b759fff16d2384596Affected b820de741ae48ccf50dd95e297889c286ff4f760 to before 961ebd120565cb60cebe21cb634fbc456022db4aAffected
LinuxLinux	4.19.308 to before 4.19.312Affected 5.4.270 to before 5.4.274Affected 5.10.211 to before 5.10.215Affected 5.15.150 to before 5.15.154Affected 6.1.80 to before 6.1.84Affected 6.6.19 to before 6.6.24Affected 6.7.7 to before 6.7.12Affected

Product

Versions

LinuxLinux

337b543e274fe7a8f47df3c8293cc6686ffa620f to before 10ca82aff58434e122c7c757cf0497c335f993f3Affected
b4eea7a05ee0ab5ab0514421e6ba8c5d249cf942 to before 396dbbc18963648e9d1a4edbb55cfe08fa374d50Affected
ea1cd64d59f22d6d13f367d62ec6e27b9344695f to before 94eb0293703ced580f05dfbe5a57da5931e9aee2Affected
d7b6fa97ec894edd02f64b83e5e72e1aa352f353 to before a71cba07783abc76b547568b6452cd1dd9981410Affected
18f614369def2a11a52f569fe0f910b199d13487 to before 18d5fc3c16cc317bd0e5f5dabe0660df415cadb7Affected
e7e23fc5d5fe422827c9a43ecb579448f73876c7 to before c01ed748847fe8b810d86efc229b9e6c7fafa01eAffected
1dc7d74fe456944a9b1c57bd776280249f441ac6 to before 5c43d0041e3a05c6c41c318b759fff16d2384596Affected
b820de741ae48ccf50dd95e297889c286ff4f760 to before 961ebd120565cb60cebe21cb634fbc456022db4aAffected

LinuxLinux

4.19.308 to before 4.19.312Affected
5.4.270 to before 5.4.274Affected
5.10.211 to before 5.10.215Affected
5.15.150 to before 5.15.154Affected
6.1.80 to before 6.1.84Affected
6.6.19 to before 6.6.24Affected
6.7.7 to before 6.7.12Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.