CVE-2024-35974

block: fix q->blkg_list corruption during disk rebind

State: Published
Severity: Not scored
Published: May 20, 2024
Updated: May 23, 2026
Reserved: May 17, 2024

Description

In the Linux kernel, the following vulnerability has been resolved:

block: fix q->blkg_list corruption during disk rebind

Multiple gendisk instances can allocated/added for single request queue in case of disk rebind. blkg may still stay in q->blkg_list when calling blkcg_init_disk() for rebind, then q->blkg_list becomes corrupted.

Fix the list corruption issue by:

- add blkg_init_queue() to initialize q->blkg_list & q->blkcg_mutex only - move calling blkg_init_queue() into blk_alloc_queue()

The list corruption should be started since commit f1c006f1c685 ("blk-cgroup: synchronize pd_free_fn() from blkg_free_workfn() and blkcg_deactivate_policy()") which delays removing blkg from q->blkg_list into blkg_free_workfn().

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	81c1188905f88b77743d1fdeeedfc8cb7b67787d to before b5dae1cd0d8368b4338430ff93403df67f0b8bccAffected bfe46d2efe46c5c952f982e2ca94fe2ec5e58e2a to before 083b58373463a6e5ee60ecb135269348f68ad7dfAffected 1059699f87eb0b3aa9d574b91a572d534897134a to before 740ffad95ca8033bd6e080ed337655b13b4d38acAffected 1059699f87eb0b3aa9d574b91a572d534897134a to before 858c489d81d659af17a4d11cfaad2afb42e47a76Affected 1059699f87eb0b3aa9d574b91a572d534897134a to before 8b8ace080319a866f5dfe9da8e665ae51d971c54Affected 6.1.16 to before 6.1.17Affected 6.2.3 to before 6.2.4Affected
LinuxLinux	5.18Affected before 5.18Not affected 6.1.17 through 6.1.Not affected 6.2.4 through 6.2.Not affected 6.6.28 through 6.6.Not affected 6.8.7 through 6.8.Not affected 6.9 and laterNot affected

Product

Versions

LinuxLinux

81c1188905f88b77743d1fdeeedfc8cb7b67787d to before b5dae1cd0d8368b4338430ff93403df67f0b8bccAffected
bfe46d2efe46c5c952f982e2ca94fe2ec5e58e2a to before 083b58373463a6e5ee60ecb135269348f68ad7dfAffected
1059699f87eb0b3aa9d574b91a572d534897134a to before 740ffad95ca8033bd6e080ed337655b13b4d38acAffected
1059699f87eb0b3aa9d574b91a572d534897134a to before 858c489d81d659af17a4d11cfaad2afb42e47a76Affected
1059699f87eb0b3aa9d574b91a572d534897134a to before 8b8ace080319a866f5dfe9da8e665ae51d971c54Affected
6.1.16 to before 6.1.17Affected
6.2.3 to before 6.2.4Affected

LinuxLinux

5.18Affected
before 5.18Not affected
6.1.17 through 6.1.*Not affected
6.2.4 through 6.2.*Not affected
6.6.28 through 6.6.*Not affected
6.8.7 through 6.8.*Not affected
6.9 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.