In the Linux kernel, the following vulnerability has been resolved:
dm: fix mempool NULL pointer race when completing IO
dm_io_dec_pending() calls end_io_acct() first and will then dec md in-flight pending count. But if a task is swapping DM table at same time this can result in a crash due to mempool->elements being NULL:
task1 task2 do_resume ->do_suspend ->dm_wait_for_completion bio_endio ->clone_endio ->dm_io_dec_pending ->end_io_acct ->wakeup task1 ->dm_swap_table ->__bind ->__bind_mempools ->bioset_exit ->mempool_exit ->free_io
[ 67.330330] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 ...... [ 67.330494] pstate: 80400085 (Nzcv daIf +PAN -UAO) [ 67.330510] pc : mempool_free+0x70/0xa0 [ 67.330515] lr : mempool_free+0x4c/0xa0 [ 67.330520] sp : ffffff8008013b20 [ 67.330524] x29: ffffff8008013b20 x28: 0000000000000004 [ 67.330530] x27: ffffffa8c2ff40a0 x26: 00000000ffff1cc8 [ 67.330535] x25: 0000000000000000 x24: ffffffdada34c800 [ 67.330541] x23: 0000000000000000 x22: ffffffdada34c800 [ 67.330547] x21: 00000000ffff1cc8 x20: ffffffd9a1304d80 [ 67.330552] x19: ffffffdada34c970 x18: 000000b312625d9c [ 67.330558] x17: 00000000002dcfbf x16: 00000000000006dd [ 67.330563] x15: 000000000093b41e x14: 0000000000000010 [ 67.330569] x13: 0000000000007f7a x12: 0000000034155555 [ 67.330574] x11: 0000000000000001 x10: 0000000000000001 [ 67.330579] x9 : 0000000000000000 x8 : 0000000000000000 [ 67.330585] x7 : 0000000000000000 x6 : ffffff80148b5c1a [ 67.330590] x5 : ffffff8008013ae0 x4 : 0000000000000001 [ 67.330596] x3 : ffffff80080139c8 x2 : ffffff801083bab8 [ 67.330601] x1 : 0000000000000000 x0 : ffffffdada34c970 [ 67.330609] Call trace: [ 67.330616] mempool_free+0x70/0xa0 [ 67.330627] bio_put+0xf8/0x110 [ 67.330638] dec_pending+0x13c/0x230 [ 67.330644] clone_endio+0x90/0x180 [ 67.330649] bio_endio+0x198/0x1b8 [ 67.330655] dec_pending+0x190/0x230 [ 67.330660] clone_endio+0x90/0x180 [ 67.330665] bio_endio+0x198/0x1b8 [ 67.330673] blk_update_request+0x214/0x428 [ 67.330683] scsi_end_request+0x2c/0x300 [ 67.330688] scsi_io_completion+0xa0/0x710 [ 67.330695] scsi_finish_command+0xd8/0x110 [ 67.330700] scsi_softirq_done+0x114/0x148 [ 67.330708] blk_done_softirq+0x74/0xd0 [ 67.330716] __do_softirq+0x18c/0x374 [ 67.330724] irq_exit+0xb4/0xb8 [ 67.330732] __handle_domain_irq+0x84/0xc0 [ 67.330737] gic_handle_irq+0x148/0x1b0 [ 67.330744] el1_irq+0xe8/0x190 [ 67.330753] lpm_cpuidle_enter+0x4f8/0x538 [ 67.330759] cpuidle_enter_state+0x1fc/0x398 [ 67.330764] cpuidle_enter+0x18/0x20 [ 67.330772] do_idle+0x1b4/0x290 [ 67.330778] cpu_startup_entry+0x20/0x28 [ 67.330786] secondary_start_kernel+0x160/0x170
Fix this by: 1) Establishing pointers to 'struct dm_io' members in dm_io_dec_pending() so that they may be passed into end_io_acct() _after_ free_io() is called. 2) Moving end_io_acct() after free_io().
CVSS Details
- CVSS 3.1 Base Score: 4.7
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade kernel-debuginfo-common-x86_64Upgrade kernel-toolsUpgrade python-perf-debuginfoUpgrade bpftool-debuginfoUpgrade python-perfUpgrade kernel-livepatch-5.10.118-111.515Upgrade bpftoolUpgrade kernel-debuginfoUpgrade kernel-livepatch-4.14.281-212.502Upgrade kernel-tools-debuginfoUpgrade perf-debuginfoUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-develUpgrade kernelUpgrade perfUpgrade kernel-tools-develUpgrade kernel-headers | May 21, 2025 | May 22, 2024 |
| Debian | — | Upgrade linux | Jul 30, 2024 | May 22, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade kernel-abi-stablelistsUpgrade kernelUpgrade kernel-toolsUpgrade python3-perfUpgrade kernel-tools-libs | Oct 8, 2024 | May 22, 2024 |
| Huawei Euleros 2_0_sp9 | — | Upgrade kernelUpgrade python3-perfUpgrade kernel-toolsUpgrade kernel-tools-libs | Oct 8, 2024 | May 22, 2024 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | May 22, 2024 |
| Suse | — | Upgrade reiserfs-kmp-defaultUpgrade kernel-rt-livepatchUpgrade dtb-amdUpgrade kernel-kvmsmall-vdsoUpgrade dtb-rockchipUpgrade kernel-debug-develUpgrade reiserfs-kmp-rtUpgrade kernel-default-vdsoUpgrade reiserfs-kmp-azureUpgrade gfs2-kmp-azureUpgrade kernel-defaultUpgrade kernel-azure-baseUpgrade dtb-marvellUpgrade kselftests-kmp-rtUpgrade kernel-default-livepatchUpgrade dtb-socionextUpgrade kernel-debug-vdsoUpgrade reiserfs-kmp-64kbUpgrade kernel-default-livepatch-develUpgrade kernel-azureUpgrade dtb-broadcomUpgrade dlm-kmp-rtUpgrade kernel-default-optionalUpgrade dtb-renesasUpgrade kernel-rt-optionalUpgrade kernel-docs-htmlUpgrade kernel-rt-vdsoUpgrade cluster-md-kmp-rtUpgrade kernel-rt-extraUpgrade kernel-azure-optionalUpgrade dtb-allwinnerUpgrade dtb-caviumUpgrade kernel-rt_debug-livepatch-develUpgrade dtb-nvidiaUpgrade ocfs2-kmp-azureUpgrade kernel-obs-buildUpgrade gfs2-kmp-defaultUpgrade cluster-md-kmp-64kbUpgrade dtb-sprdUpgrade kselftests-kmp-azureUpgrade ocfs2-kmp-defaultUpgrade kernel-rt_debug-develUpgrade ocfs2-kmp-64kbUpgrade dlm-kmp-defaultUpgrade kernel-develUpgrade dtb-xilinxUpgrade kernel-source-vanillaUpgrade kernel-default-baseUpgrade kernel-default-base-rebuildUpgrade kernel-docsUpgrade dtb-alteraUpgrade kernel-preempt-develUpgrade kernel-source-rtUpgrade kernel-64kb-extraUpgrade kernel-64kb-optionalUpgrade kernel-kvmsmall-develUpgrade kernel-debug-livepatch-develUpgrade dtb-amlogicUpgrade kernel-syms-azureUpgrade dtb-freescaleUpgrade kernel-macrosUpgrade dtb-exynosUpgrade dtb-qcomUpgrade dtb-apmUpgrade ocfs2-kmp-rtUpgrade kernel-devel-rtUpgrade kernel-debugUpgrade gfs2-kmp-64kbUpgrade cluster-md-kmp-defaultUpgrade dtb-armUpgrade kernel-default-extraUpgrade kernel-zfcpdumpUpgrade kernel-azure-livepatch-develUpgrade kernel-sourceUpgrade kernel-rt-develUpgrade dtb-amazonUpgrade kernel-64kbUpgrade dtb-mediatekUpgrade kselftests-kmp-defaultUpgrade kernel-azure-extraUpgrade kselftests-kmp-64kbUpgrade kernel-kvmsmall-livepatch-develUpgrade kernel-64kb-livepatch-develUpgrade kernel-syms-rtUpgrade kernel-rt-livepatch-develUpgrade kernel-rt_debugUpgrade kernel-kvmsmallUpgrade kernel-default-develUpgrade dtb-hisiliconUpgrade cluster-md-kmp-azureUpgrade kernel-rtUpgrade dtb-lgUpgrade kernel-azure-develUpgrade kernel-obs-qaUpgrade kernel-azure-vdsoUpgrade kernel-devel-azureUpgrade gfs2-kmp-rtUpgrade kernel-preemptUpgrade kernel-rt_debug-vdsoUpgrade kernel-64kb-develUpgrade kernel-symsUpgrade dlm-kmp-64kbUpgrade kernel-source-azureUpgrade dlm-kmp-azureUpgrade kernel-default-manUpgrade dtb-apple | Aug 9, 2024 | May 22, 2024 |
| Ubuntu | — | Upgrade linux-gcp-fipsUpgrade linux-ibmUpgrade linux-gkeopUpgrade linux-azure-4.15Upgrade linuxUpgrade linux-azure-fipsUpgrade linux-gcpUpgrade linux-azure-fde-5.15Upgrade linux-oracleUpgrade linux-gcp-5.4Upgrade linux-aws-hweUpgrade linux-gcp-4.15Upgrade linux-hweUpgrade linux-aws-fipsUpgrade linux-hwe-5.4Upgrade linux-ibm-5.4Upgrade linux-kvmUpgrade linux-bluefieldUpgrade linux-iotUpgrade linux-raspiUpgrade linux-fipsUpgrade linux-raspi-5.4Upgrade linux-azure-5.4Upgrade linux-awsUpgrade linux-aws-5.4Upgrade linux-azureUpgrade linux-oracle-5.4 | Nov 19, 2024 | May 22, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | May 27, 2026 | May 22, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub