{"id":"CVE-2024-57875","state":"PUBLISHED","title":"block: RCU protect disk->conv_zones_bitmap","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nblock: RCU protect disk->conv_zones_bitmap\n\nEnsure that a disk revalidation changing the conventional zones bitmap\nof a disk does not cause invalid memory references when using the\ndisk_zone_is_conv() helper by RCU protecting the disk->conv_zones_bitmap\npointer.\n\ndisk_zone_is_conv() is modified to operate under the RCU read lock and\nthe function disk_set_conv_zones_bitmap() is added to update a disk\nconv_zones_bitmap pointer using rcu_replace_pointer() with the disk\nzone_wplugs_lock spinlock held.\n\ndisk_free_zone_resources() is modified to call\ndisk_update_zone_resources() with a NULL bitmap pointer to free the disk\nconv_zones_bitmap. disk_set_conv_zones_bitmap() is also used in\ndisk_update_zone_resources() to set the new (revalidated) bitmap and\nfree the old one.","publishedAt":"2025-01-11T14:49:01.655Z","updatedAt":"2026-10-15T21:51:49.436Z","severity":{"score":7.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"dd291d77cc90eb6a86e9860ba8e6e38eebd57d12","status":"affected","lessThan":"493326c4f10cc71a42c27fdc97ce112182ee4cbc","versionType":"git"},{"version":"dd291d77cc90eb6a86e9860ba8e6e38eebd57d12","status":"affected","lessThan":"d7cb6d7414ea1b33536fa6d11805cb8dceec1f97","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["block/blk-zoned.c","include/linux/blkdev.h"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.10","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.10","versionType":"semver"},{"version":"6.12.5","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.13","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["block/blk-zoned.c","include/linux/blkdev.h"]}],"references":["https://git.kernel.org/stable/c/493326c4f10cc71a42c27fdc97ce112182ee4cbc","https://git.kernel.org/stable/c/d7cb6d7414ea1b33536fa6d11805cb8dceec1f97"],"weaknesses":[],"ingestedAt":"2026-10-29T20:08:12.933Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/57xxx/CVE-2024-57875.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2024-57875","state":"PUBLISHED","datePublished":"2025-01-11T14:49:01.655Z","dateUpdated":"2026-10-15T21:51:49.436Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2025-01-11T14:45:42.023Z"},"containers":{"cna":{"title":"block: RCU protect disk->conv_zones_bitmap","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nblock: RCU protect disk->conv_zones_bitmap\n\nEnsure that a disk revalidation changing the conventional zones bitmap\nof a disk does not cause invalid memory references when using the\ndisk_zone_is_conv() helper by RCU protecting the disk->conv_zones_bitmap\npointer.\n\ndisk_zone_is_conv() is modified to operate under the RCU read lock and\nthe function disk_set_conv_zones_bitmap() is added to update a disk\nconv_zones_bitmap pointer using rcu_replace_pointer() with the disk\nzone_wplugs_lock spinlock held.\n\ndisk_free_zone_resources() is modified to call\ndisk_update_zone_resources() with a NULL bitmap pointer to free the disk\nconv_zones_bitmap. disk_set_conv_zones_bitmap() is also used in\ndisk_update_zone_resources() to set the new (revalidated) bitmap and\nfree the old one."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"dd291d77cc90eb6a86e9860ba8e6e38eebd57d12","status":"affected","lessThan":"493326c4f10cc71a42c27fdc97ce112182ee4cbc","versionType":"git"},{"version":"dd291d77cc90eb6a86e9860ba8e6e38eebd57d12","status":"affected","lessThan":"d7cb6d7414ea1b33536fa6d11805cb8dceec1f97","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["block/blk-zoned.c","include/linux/blkdev.h"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.10","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.10","versionType":"semver"},{"version":"6.12.5","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.13","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["block/blk-zoned.c","include/linux/blkdev.h"]}],"references":[{"url":"https://git.kernel.org/stable/c/493326c4f10cc71a42c27fdc97ce112182ee4cbc"},{"url":"https://git.kernel.org/stable/c/d7cb6d7414ea1b33536fa6d11805cb8dceec1f97"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable helper is reached only through the local block I/O submission path (`submit_bio`/`blk_mq_submit_bio` → `blk_zone_plug_bio`) and zone-management ioctls (`BLKRESETZONE`/`BLKFINISHZONE`) against a zoned block device node or a filesystem mounted on it. There is no network protocol handler in the path; the racing revalidation is a local block-layer/driver operation.\nAC:L - The attacker fully controls the reader side and can drive `disk_zone_is_conv()` continuously and indefinitely with a cheap write/zone-reset loop, so the race can be retried without limit at no cost until a revalidation (admin rescan, `BLKRRPART`, DM table reload, or a device-driven SCSI capacity-change unit attention / NVMe namespace-changed AEN, all of which recur in normal operation) lands in the window. No specific memory layout or victim state that the attacker cannot influence is required.\nPR:L - An ordinary unprivileged local user only needs write access to the zoned block device or to a filesystem on it (common for containers given a ZNS namespace, storage hosts with SMR disks, and Android/embedded systems running f2fs on zoned storage) to keep the vulnerable read path hot. No capability check guards `blk_zone_plug_bio()` on the submission path.\nUI:N - Triggering requires only the attacker's own I/O against the zoned device concurrently with a revalidation event; no victim has to open a file, mount a filesystem, or take any other action.\nS:U - The freed bitmap and the corrupted decision logic are both kernel block-layer state, so the impact stays within the kernel's own security authority. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - `test_bit()` on the freed bitmap reads memory that may already have been reallocated to another kernel object, and the resulting bit value is observable to the attacker through the differing I/O behavior (zone append accepted vs. `-EIO`), yielding a use-after-free read oracle over recycled kernel heap contents.\nI:H - A stale/freed bitmap can make a sequential-write-required zone be classified as conventional, causing writes to bypass zone write plugging entirely and be issued out of order to the device — corrupting on-disk data on the zoned device — and the use-after-free read is the kind of memory-safety defect that is treated as exploitable for further corruption.\nA:H - Dereferencing the freed bitmap can oops the kernel (kvmalloc/vmalloc-backed bitmaps for large zone counts become unmapped on free, and KASAN/DEBUG_PAGEALLOC builds fault immediately), and even without a fault the misclassification produces write-ordering failures that force I/O errors and filesystem shutdown on the zoned device."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-08-05T11:46:43.350Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.10","versionEndExcluding":"6.12.5"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.10","versionEndExcluding":"6.13"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2024-57875","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-15T21:41:37.194951Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-10-15T21:51:49.436Z"}}]}}}