- 5.5MediumCVSS base score
- 0.24%Exploitation in 30 daysEPSS · top 85% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: io_uring/tctx: work around xa_store() allocation error issue syzbot triggered the following WARN_ON: WARNING: CPU: 0 PID: 16 at io_uring/tctx.c:51 __io_uring_free+0xfa/0x140 io_uring/tctx.c:51 which is the WARN_ON_ONCE(!xa_empty(&tctx->xa)); sanity check in __io_uring_free() when a io_uring_task is going through its final put. The syzbot test case includes injecting memory allocation failures, and it very much looks like xa_store() can fail one of its memory allocations and end up with ->head being non-NULL even though no entries exist in the xarray. Until this issue gets sorted out, work around it by attempting to iterate entries in our xarray, and WARN_ON_ONCE() if one is found.
Timeline
ID reserved
By Linux
Published
- 23 months later
· 23 months later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| NVDNVD · Modified | 3.1 | Medium5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
- EPSS (exploitation in 30 days)
- 0.24% · top 85% of all CVEs (12 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.5.
Affected products
- affected 2b188cc1bb857a9d4701ae59aa7768b5124e262e – < e05c070b401f6365c503e2b59f091331965c4fb9
- affected 2b188cc1bb857a9d4701ae59aa7768b5124e262e – < 3a84fa784710990964c1e35df743851ab2863898
- affected 2b188cc1bb857a9d4701ae59aa7768b5124e262e – < 94ad56f61b873ffeebcc620d451eacfbdf9d40f0
- affected 2b188cc1bb857a9d4701ae59aa7768b5124e262e – < 42882b583095dcf747da6e3af1daeff40e27033e
- affected 2b188cc1bb857a9d4701ae59aa7768b5124e262e – < d5b2ddf1f90c7248eff9630b95895c8950f2f36d
- affected 2b188cc1bb857a9d4701ae59aa7768b5124e262e – < 7eb75ce7527129d7f1fee6951566af409a37a1c4
- affected 5.1
- unaffected < 5.1
- unaffected 5.10.253 – ≤ 5.10.*
- unaffected 5.15.203 – ≤ 5.15.*
- unaffected 6.1.120 – ≤ 6.1.*
- unaffected 6.6.66 – ≤ 6.6.*
- unaffected 6.12.5 – ≤ 6.12.*
- unaffected 6.13 – ≤ *
References
References7
- https://git.kernel.org/stable/c/e05c070b401f6365c503e2b59f091331965c4fb9 (opens in a new tab)
- https://git.kernel.org/stable/c/3a84fa784710990964c1e35df743851ab2863898 (opens in a new tab)
- https://git.kernel.org/stable/c/94ad56f61b873ffeebcc620d451eacfbdf9d40f0 (opens in a new tab)
- https://git.kernel.org/stable/c/42882b583095dcf747da6e3af1daeff40e27033e (opens in a new tab)
- https://git.kernel.org/stable/c/d5b2ddf1f90c7248eff9630b95895c8950f2f36d (opens in a new tab)
- https://git.kernel.org/stable/c/7eb75ce7527129d7f1fee6951566af409a37a1c4 (opens in a new tab)
- https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2024-53232 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2024-56584)Record last updated .