AI Score
Confidence
Low
EPSS
Percentile
15.5%
SSVC
Exploitation
none
Automatable
no
Technical Impact
partial
In the Linux kernel, the following vulnerability has been resolved:
tmpfs: fix race on handling dquot rbtree
A syzkaller reproducer found a race while attempting to remove dquot
information from the rb tree.
Fetching the rb_tree root node must also be protected by the
dqopt->dqio_sem, otherwise, giving the right timing, shmem_release_dquot()
will trigger a warning because it couldn’t find a node in the tree, when
the real reason was the root node changing before the search starts:
Thread 1 Thread 2
shmem_release_dquot() - shmem_{acquire,release}_dquot()
fetch ROOT - Fetch ROOT
- acquire dqio_sem
wait dqio_sem
- do something, triger a tree rebalance
- release dqio_sem
acquire dqio_sem
start searching for the node, but
from the wrong location, missing
the node, and triggering a warning.
[
{
"product": "Linux",
"vendor": "Linux",
"defaultStatus": "unaffected",
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"programFiles": [
"mm/shmem_quota.c"
],
"versions": [
{
"version": "eafc474e2029",
"lessThan": "c7077f43f30d",
"status": "affected",
"versionType": "git"
},
{
"version": "eafc474e2029",
"lessThan": "617d55b90e73",
"status": "affected",
"versionType": "git"
},
{
"version": "eafc474e2029",
"lessThan": "f82f184874d2",
"status": "affected",
"versionType": "git"
},
{
"version": "eafc474e2029",
"lessThan": "0a69b6b3a026",
"status": "affected",
"versionType": "git"
}
]
},
{
"product": "Linux",
"vendor": "Linux",
"defaultStatus": "affected",
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"programFiles": [
"mm/shmem_quota.c"
],
"versions": [
{
"version": "6.6",
"status": "affected"
},
{
"version": "0",
"lessThan": "6.6",
"status": "unaffected",
"versionType": "custom"
},
{
"version": "6.6.24",
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"versionType": "custom"
},
{
"version": "6.7.12",
"lessThanOrEqual": "6.7.*",
"status": "unaffected",
"versionType": "custom"
},
{
"version": "6.8.3",
"lessThanOrEqual": "6.8.*",
"status": "unaffected",
"versionType": "custom"
},
{
"version": "6.9",
"lessThanOrEqual": "*",
"status": "unaffected",
"versionType": "original_commit_for_fix"
}
]
}
]