Skip to content
CVE Ledger
  • Newest CVEsPage
  • Recently added to KEVPage
  • Rising exploitation (EPSS)Page
  • Weekly digestPage
  • StatisticsPage
  • WatchlistPage
  • API docsPage
  • MCP serverPage
  • AboutPage
  • Data sourcesPage
  • Data statusPage
  • ChangelogPage
  • How it's builtPage
  • Support the projectPage

14 results

Back

CVE-2024-27005interconnect: Don't access req_list while it's being manipulated

Description

In the Linux kernel, the following vulnerability has been resolved: interconnect: Don't access req_list while it's being manipulated The icc_lock mutex was split into separate icc_lock and icc_bw_lock mutexes in [1] to avoid lockdep splats. However, this didn't adequately protect access to icc_node::req_list. The icc_set_bw() function will eventually iterate over req_list while only holding icc_bw_lock, but req_list can be modified while only holding icc_lock. This causes races between icc_set_bw(), of_icc_get(), and icc_put(). Example A: CPU0 CPU1 ---- ---- icc_set_bw(path_a) mutex_lock(&icc_bw_lock); icc_put(path_b) mutex_lock(&icc_lock); aggregate_requests() hlist_for_each_entry(r, ... hlist_del(... <r = invalid pointer> Example B: CPU0 CPU1 ---- ---- icc_set_bw(path_a) mutex_lock(&icc_bw_lock); path_b = of_icc_get() of_icc_get_by_index() mutex_lock(&icc_lock); path_find() path_init() aggregate_requests() hlist_for_each_entry(r, ... hlist_add_head(... <r = invalid pointer> Fix this by ensuring icc_bw_lock is always held before manipulating icc_node::req_list. The additional places icc_bw_lock is held don't perform any memory allocations, so we should still be safe from the original lockdep splats that motivated the separate locks. [1] commit af42269c3523 ("interconnect: Fix locking for runpm vs reclaim")

Timeline

  1. ID reserved

    By Linux

  2. · 2 months later

    Published

  3. · 2 years later

    Record updated

Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.

Scores

CVSS scores of CVE-2024-27005, by who scored it
Scored byCVSSScoreVector
LinuxCNA (assigner)3.1High7.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CISA-ADPADP (enrichment)3.1Medium6.3CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:H
NVDNVD · Modified3.1High7.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS (exploitation in 30 days)
0.19% · top 91% of all CVEs (12 Nov 2026)
CISA SSVC
Exploitation: none · Automatable: no · Technical impact: partial
Loading the EPSS history…

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.8.

Affected products

  • Linux · Linux

    • affected 9be2957f014d91088db1eb5dd09d9a03d7184dce – < fe549d8e976300d0dd75bd904eb216bed8b145e0
    • affected ee42bfc791aa3cd78e29046f26a09d189beb3efb – < 19ec82b3cad1abef2a929262b8c1528f4e0c192d
    • affected ffb8917c70a4c88725ee40f9eeee9240ad1c1869 – < 8401bc2c188030fb14d1cb43c402a1cf42d86dd2
    • affected af42269c3523492d71ebbe11fefae2653e9cdc78 – < d0d04efa2e367921654b5106cc5c05e3757c2b42
    • affected af42269c3523492d71ebbe11fefae2653e9cdc78 – < 4c65507121ea8e0b47fae6d2049c8688390d46b6
    • affected af42269c3523492d71ebbe11fefae2653e9cdc78 – < de1bf25b6d771abdb52d43546cf57ad775fb68a1
    • affected 2f3a124696d43de3c837f87a9f767c56ee86cf2a
    • affected 5.15.133 – < 5.15.151
    • affected 6.1.55 – < 6.1.81
    • affected 6.5.5 – < 6.6

  • Linux · Linux

    • affected 6.6
    • unaffected < 6.6
    • unaffected 5.15.151 – ≤ 5.15.*
    • unaffected 6.1.81 – ≤ 6.1.*
    • unaffected 6.6.29 – ≤ 6.6.*
    • unaffected 6.8.8 – ≤ 6.8.*
    • unaffected 6.9 – ≤ *

References

References9

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

CVE-2024-27005 badge
[![CVE-2024-27005](https://cveledger.app/badge/CVE-2024-27005.svg)](https://cveledger.app/cve/CVE-2024-27005)

Record last updated .