In the Linux kernel, the following vulnerability has been resolved:
dm: fix mempool NULL pointer race when completing IO
dm_io_dec_pending() calls end_io_acct() first and will then dec md in-flight pending count. But if a task is swapping DM table at same time this can result in a crash due to mempool->elements being NULL:
task1 task2 do_resume ->do_suspend ->dm_wait_for_completion bio_endio ->clone_endio ->dm_io_dec_pending ->end_io_acct ->wakeup task1 ->dm_swap_table ->__bind ->__bind_mempools ->bioset_exit ->mempool_exit ->free_io
[ 67.330330] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 ...... [ 67.330494] pstate: 80400085 (Nzcv daIf +PAN -UAO) [ 67.330510] pc : mempool_free+0x70/0xa0 [ 67.330515] lr : mempool_free+0x4c/0xa0 [ 67.330520] sp : ffffff8008013b20 [ 67.330524] x29: ffffff8008013b20 x28: 0000000000000004 [ 67.330530] x27: ffffffa8c2ff40a0 x26: 00000000ffff1cc8 [ 67.330535] x25: 0000000000000000 x24: ffffffdada34c800 [ 67.330541] x23: 0000000000000000 x22: ffffffdada34c800 [ 67.330547] x21: 00000000ffff1cc8 x20: ffffffd9a1304d80 [ 67.330552] x19: ffffffdada34c970 x18: 000000b312625d9c [ 67.330558] x17: 00000000002dcfbf x16: 00000000000006dd [ 67.330563] x15: 000000000093b41e x14: 0000000000000010 [ 67.330569] x13: 0000000000007f7a x12: 0000000034155555 [ 67.330574] x11: 0000000000000001 x10: 0000000000000001 [ 67.330579] x9 : 0000000000000000 x8 : 0000000000000000 [ 67.330585] x7 : 0000000000000000 x6 : ffffff80148b5c1a [ 67.330590] x5 : ffffff8008013ae0 x4 : 0000000000000001 [ 67.330596] x3 : ffffff80080139c8 x2 : ffffff801083bab8 [ 67.330601] x1 : 0000000000000000 x0 : ffffffdada34c970 [ 67.330609] Call trace: [ 67.330616] mempool_free+0x70/0xa0 [ 67.330627] bio_put+0xf8/0x110 [ 67.330638] dec_pending+0x13c/0x230 [ 67.330644] clone_endio+0x90/0x180 [ 67.330649] bio_endio+0x198/0x1b8 [ 67.330655] dec_pending+0x190/0x230 [ 67.330660] clone_endio+0x90/0x180 [ 67.330665] bio_endio+0x198/0x1b8 [ 67.330673] blk_update_request+0x214/0x428 [ 67.330683] scsi_end_request+0x2c/0x300 [ 67.330688] scsi_io_completion+0xa0/0x710 [ 67.330695] scsi_finish_command+0xd8/0x110 [ 67.330700] scsi_softirq_done+0x114/0x148 [ 67.330708] blk_done_softirq+0x74/0xd0 [ 67.330716] __do_softirq+0x18c/0x374 [ 67.330724] irq_exit+0xb4/0xb8 [ 67.330732] __handle_domain_irq+0x84/0xc0 [ 67.330737] gic_handle_irq+0x148/0x1b0 [ 67.330744] el1_irq+0xe8/0x190 [ 67.330753] lpm_cpuidle_enter+0x4f8/0x538 [ 67.330759] cpuidle_enter_state+0x1fc/0x398 [ 67.330764] cpuidle_enter+0x18/0x20 [ 67.330772] do_idle+0x1b4/0x290 [ 67.330778] cpu_startup_entry+0x20/0x28 [ 67.330786] secondary_start_kernel+0x160/0x170
Fix this by: 1) Establishing pointers to 'struct dm_io' members in dm_io_dec_pending() so that they may be passed into end_io_acct() _after_ free_io() is called. 2) Moving end_io_acct() after free_io().
CVSS Details
- CVSS 3.1 Base Score: 4.7
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade kernel-livepatch-4.14.281-212.502Upgrade kernel-debuginfoUpgrade kernel-headersUpgrade perf-debuginfoUpgrade kernel-debuginfo-common-aarch64Upgrade kernelUpgrade kernel-tools-debuginfoUpgrade perfUpgrade kernel-develUpgrade kernel-tools-develUpgrade bpftoolUpgrade bpftool-debuginfoUpgrade python-perfUpgrade kernel-livepatch-5.10.118-111.515Upgrade kernel-debuginfo-common-x86_64Upgrade kernel-toolsUpgrade python-perf-debuginfo | May 21, 2025 | May 22, 2024 |
| Debian | — | Upgrade linux | Jul 30, 2024 | May 22, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade kernelUpgrade python3-perfUpgrade kernel-toolsUpgrade kernel-abi-stablelistsUpgrade kernel-tools-libs | Oct 8, 2024 | May 22, 2024 |
| Huawei Euleros 2_0_sp9 | — | Upgrade python3-perfUpgrade kernelUpgrade kernel-tools-libsUpgrade kernel-tools | Oct 8, 2024 | May 22, 2024 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | May 22, 2024 |
| Suse | — | Upgrade kselftests-kmp-defaultUpgrade dtb-armUpgrade cluster-md-kmp-defaultUpgrade gfs2-kmp-64kbUpgrade kernel-kvmsmall-develUpgrade kselftests-kmp-64kbUpgrade kernel-64kb-livepatch-develUpgrade gfs2-kmp-rtUpgrade dtb-mediatekUpgrade ocfs2-kmp-rtUpgrade kernel-syms-rtUpgrade dtb-exynosUpgrade kernel-devel-rtUpgrade kernel-debugUpgrade kernel-rt-develUpgrade dtb-apmUpgrade dtb-qcomUpgrade kernel-64kb-optionalUpgrade dtb-amlogicUpgrade dtb-freescaleUpgrade kernel-sourceUpgrade kernel-azure-extraUpgrade kernel-zfcpdumpUpgrade kernel-obs-qaUpgrade kernel-azure-vdsoUpgrade kernel-rt_debugUpgrade dtb-lgUpgrade dtb-appleUpgrade dlm-kmp-azureUpgrade dtb-hisiliconUpgrade dlm-kmp-64kbUpgrade kernel-64kb-develUpgrade kernel-symsUpgrade kernel-preemptUpgrade kernel-rt-livepatch-develUpgrade kernel-rtUpgrade kernel-azure-develUpgrade kernel-syms-azureUpgrade kernel-rt_debug-vdsoUpgrade kernel-azure-livepatch-develUpgrade kernel-devel-azureUpgrade kernel-default-develUpgrade kernel-kvmsmallUpgrade kernel-macrosUpgrade kernel-source-azureUpgrade kernel-64kbUpgrade cluster-md-kmp-azureUpgrade kernel-default-manUpgrade kernel-default-extraUpgrade dtb-amazonUpgrade kernel-debug-livepatch-develUpgrade kernel-kvmsmall-livepatch-develUpgrade kernel-source-vanillaUpgrade dtb-rockchipUpgrade kernel-develUpgrade kernel-rt-vdsoUpgrade kernel-kvmsmall-vdsoUpgrade kernel-default-livepatchUpgrade dtb-marvellUpgrade kernel-docsUpgrade ocfs2-kmp-azureUpgrade kernel-rt_debug-livepatch-develUpgrade dtb-nvidiaUpgrade dlm-kmp-rtUpgrade reiserfs-kmp-64kbUpgrade kernel-debug-develUpgrade kernel-debug-vdsoUpgrade cluster-md-kmp-rtUpgrade cluster-md-kmp-64kbUpgrade dtb-alteraUpgrade kernel-rt-extraUpgrade dtb-socionextUpgrade kernel-obs-buildUpgrade reiserfs-kmp-azureUpgrade dlm-kmp-defaultUpgrade dtb-sprdUpgrade kernel-64kb-extraUpgrade kernel-default-baseUpgrade dtb-broadcomUpgrade ocfs2-kmp-defaultUpgrade kernel-defaultUpgrade kselftests-kmp-azureUpgrade kernel-default-optionalUpgrade dtb-xilinxUpgrade kernel-default-base-rebuildUpgrade reiserfs-kmp-rtUpgrade ocfs2-kmp-64kbUpgrade dtb-allwinnerUpgrade kernel-rt-livepatchUpgrade kernel-preempt-develUpgrade reiserfs-kmp-defaultUpgrade kernel-rt_debug-develUpgrade kernel-azure-optionalUpgrade dtb-renesasUpgrade dtb-amdUpgrade kernel-source-rtUpgrade gfs2-kmp-defaultUpgrade kernel-azureUpgrade kernel-rt-optionalUpgrade kernel-default-vdsoUpgrade kernel-default-livepatch-develUpgrade kernel-docs-htmlUpgrade gfs2-kmp-azureUpgrade dtb-caviumUpgrade kselftests-kmp-rtUpgrade kernel-azure-base | Aug 9, 2024 | May 22, 2024 |
| Ubuntu | — | Upgrade linux-hwe-5.4Upgrade linux-azure-4.15Upgrade linux-gkeopUpgrade linux-azure-fipsUpgrade linux-ibmUpgrade linux-gcp-4.15Upgrade linux-aws-fipsUpgrade linuxUpgrade linux-oracleUpgrade linux-gcp-fipsUpgrade linux-gcp-5.4Upgrade linux-gcpUpgrade linux-azure-fde-5.15Upgrade linux-ibm-5.4Upgrade linux-hweUpgrade linux-aws-hweUpgrade linux-kvmUpgrade linux-fipsUpgrade linux-azure-5.4Upgrade linux-raspiUpgrade linux-oracle-5.4Upgrade linux-aws-5.4Upgrade linux-iotUpgrade linux-raspi-5.4Upgrade linux-bluefieldUpgrade linux-azureUpgrade linux-aws | Nov 19, 2024 | May 22, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | May 27, 2026 | May 22, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub