Description
In the Linux kernel, the following vulnerability has been resolved: nbd: fix race between timeout and normal completion If request timetout is handled by nbd_requeue_cmd(), normal completion has to be stopped for avoiding to complete this requeued request, other use-after-free can be triggered. Fix the race by clearing NBD_CMD_INFLIGHT in nbd_requeue_cmd(), meantime make sure that cmd->lock is grabbed for clearing the flag and the requeue.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
2895f1831e911ca87d4efdf43e35eb72a0c7e66e to < 9c25faf72d780a9c71081710cd48759d61ff6e9baffected2895f1831e911ca87d4efdf43e35eb72a0c7e66e to < 6e73b946a379a1dfbb62626af93843bdfb53753daffected2895f1831e911ca87d4efdf43e35eb72a0c7e66e to < 5236ada8ebbd9e7461f17477357582f5be4f46f7affected2895f1831e911ca87d4efdf43e35eb72a0c7e66e to < 9a74c3e6c0d686c26ba2aab66d15ddb89dc139ccaffected2895f1831e911ca87d4efdf43e35eb72a0c7e66e to < c9ea57c91f03bcad415e1a20113bdb2077bcf990affectedcdf62c535a9bfd5ff0eef4b91669da39d8abc0c3affected5171ef20bae852ff38f4cfdb368bcdcc744776d0affected5.17.15 to < 5.18affected5.18.4 to < 5.19affected
Linux Linux
Default version status: affected
5.19affected0 to < 5.19unaffected6.1.113 to ≤ 6.1.*unaffected6.6.54 to ≤ 6.6.*unaffected6.10.13 to ≤ 6.10.*unaffected6.11.2 to ≤ 6.11.*unaffected6.12 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/9c25faf72d780a9c71081710cd48759d61ff6e9b ↗
- https://git.kernel.org/stable/c/6e73b946a379a1dfbb62626af93843bdfb53753d ↗
- https://git.kernel.org/stable/c/5236ada8ebbd9e7461f17477357582f5be4f46f7 ↗
- https://git.kernel.org/stable/c/9a74c3e6c0d686c26ba2aab66d15ddb89dc139cc ↗
- https://git.kernel.org/stable/c/c9ea57c91f03bcad415e1a20113bdb2077bcf990 ↗
- https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html ↗