{"schema_version":"1.9.0","id":"CVE-2024-26671","published":"2024-04-02T06:49:13.834Z","modified":"2026-08-12T03:51:33.628692055Z","related":["SUSE-SU-2024:1643-1","SUSE-SU-2024:1644-1","SUSE-SU-2024:1646-1","SUSE-SU-2024:1659-1","SUSE-SU-2024:1663-1","SUSE-SU-2024:1870-1","SUSE-SU-2024:2135-1","SUSE-SU-2024:2203-1","SUSE-SU-2024:2973-1","SUSE-SU-2025:20008-1","SUSE-SU-2025:20028-1","USN-6818-2","USN-6819-2"],"summary":"blk-mq: fix IO hang from sbitmap wakeup race","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nblk-mq: fix IO hang from sbitmap wakeup race\n\nIn blk_mq_mark_tag_wait(), __add_wait_queue() may be re-ordered\nwith the following blk_mq_get_driver_tag() in case of getting driver\ntag failure.\n\nThen in __sbitmap_queue_wake_up(), waitqueue_active() may not observe\nthe added waiter in blk_mq_mark_tag_wait() and wake up nothing, meantime\nblk_mq_mark_tag_wait() can't get driver tag successfully.\n\nThis issue can be reproduced by running the following test in loop, and\nfio hang can be observed in < 30min when running it on my test VM\nin laptop.\n\n\tmodprobe -r scsi_debug\n\tmodprobe scsi_debug delay=0 dev_size_mb=4096 max_queue=1 host_max_queue=1 submit_queues=4\n\tdev=`ls -d /sys/bus/pseudo/drivers/scsi_debug/adapter*/host*/target*/*/block/* | head -1 | xargs basename`\n\tfio --filename=/dev/\"$dev\" --direct=1 --rw=randrw --bs=4k --iodepth=1 \\\n       \t\t--runtime=100 --numjobs=40 --time_based --name=test \\\n        \t--ioengine=libaio\n\nFix the issue by adding one explicit barrier in blk_mq_mark_tag_wait(), which\nis just fine in case of running out of tag.","affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"da55f2cc78418dee88400aafbbaed19d7ac8188e"},{"fixed":"9525b38180e2753f0daa1a522b7767a2aa969676"},{"fixed":"ecd7744a1446eb02ccc63e493e2eb6ede4ef1e10"},{"fixed":"7610ba1319253225a9ba8a9d28d472fc883b4e2f"},{"fixed":"89e0e66682e1538aeeaa3109503473663cd24c8b"},{"fixed":"1d9c777d3e70bdc57dddf7a14a80059d65919e56"},{"fixed":"6d8b01624a2540336a32be91f25187a433af53a0"},{"fixed":"f1bc0d8163f8ee84a8d5affdf624cfad657df1d2"},{"fixed":"5266caaf5660529e3da53004b8b7174cab6374ed"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-26671.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.11.0"},{"fixed":"4.19.307"}]},{"type":"ECOSYSTEM","events":[{"introduced":"4.20.0"},{"fixed":"5.4.269"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.5.0"},{"fixed":"5.10.210"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.11.0"},{"fixed":"5.15.149"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.16.0"},{"fixed":"6.1.77"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.2.0"},{"fixed":"6.6.16"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.7.0"},{"fixed":"6.7.4"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-26671.json"}}],"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/1d9c777d3e70bdc57dddf7a14a80059d65919e56"},{"type":"WEB","url":"https://git.kernel.org/stable/c/5266caaf5660529e3da53004b8b7174cab6374ed"},{"type":"WEB","url":"https://git.kernel.org/stable/c/6d8b01624a2540336a32be91f25187a433af53a0"},{"type":"WEB","url":"https://git.kernel.org/stable/c/7610ba1319253225a9ba8a9d28d472fc883b4e2f"},{"type":"WEB","url":"https://git.kernel.org/stable/c/89e0e66682e1538aeeaa3109503473663cd24c8b"},{"type":"WEB","url":"https://git.kernel.org/stable/c/9525b38180e2753f0daa1a522b7767a2aa969676"},{"type":"WEB","url":"https://git.kernel.org/stable/c/ecd7744a1446eb02ccc63e493e2eb6ede4ef1e10"},{"type":"WEB","url":"https://git.kernel.org/stable/c/f1bc0d8163f8ee84a8d5affdf624cfad657df1d2"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/26xxx/CVE-2024-26671.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26671"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"database_specific":{"cna_assigner":"Linux","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/26xxx/CVE-2024-26671.json"}}