In the Linux kernel, the following vulnerability has been resolved:
dm: fix mempool NULL pointer race when completing IO
dm_io_dec_pending() calls end_io_acct() first and will then dec md in-flight pending count. But if a task is swapping DM table at same time this can result in a crash due to mempool->elements being NULL:
task1 task2 do_resume ->do_suspend ->dm_wait_for_completion bio_endio ->clone_endio ->dm_io_dec_pending ->end_io_acct ->wakeup task1 ->dm_swap_table ->__bind ->__bind_mempools ->bioset_exit ->mempool_exit ->free_io
[ 67.330330] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 ...... [ 67.330494] pstate: 80400085 (Nzcv daIf +PAN -UAO) [ 67.330510] pc : mempool_free+0x70/0xa0 [ 67.330515] lr : mempool_free+0x4c/0xa0 [ 67.330520] sp : ffffff8008013b20 [ 67.330524] x29: ffffff8008013b20 x28: 0000000000000004 [ 67.330530] x27: ffffffa8c2ff40a0 x26: 00000000ffff1cc8 [ 67.330535] x25: 0000000000000000 x24: ffffffdada34c800 [ 67.330541] x23: 0000000000000000 x22: ffffffdada34c800 [ 67.330547] x21: 00000000ffff1cc8 x20: ffffffd9a1304d80 [ 67.330552] x19: ffffffdada34c970 x18: 000000b312625d9c [ 67.330558] x17: 00000000002dcfbf x16: 00000000000006dd [ 67.330563] x15: 000000000093b41e x14: 0000000000000010 [ 67.330569] x13: 0000000000007f7a x12: 0000000034155555 [ 67.330574] x11: 0000000000000001 x10: 0000000000000001 [ 67.330579] x9 : 0000000000000000 x8 : 0000000000000000 [ 67.330585] x7 : 0000000000000000 x6 : ffffff80148b5c1a [ 67.330590] x5 : ffffff8008013ae0 x4 : 0000000000000001 [ 67.330596] x3 : ffffff80080139c8 x2 : ffffff801083bab8 [ 67.330601] x1 : 0000000000000000 x0 : ffffffdada34c970 [ 67.330609] Call trace: [ 67.330616] mempool_free+0x70/0xa0 [ 67.330627] bio_put+0xf8/0x110 [ 67.330638] dec_pending+0x13c/0x230 [ 67.330644] clone_endio+0x90/0x180 [ 67.330649] bio_endio+0x198/0x1b8 [ 67.330655] dec_pending+0x190/0x230 [ 67.330660] clone_endio+0x90/0x180 [ 67.330665] bio_endio+0x198/0x1b8 [ 67.330673] blk_update_request+0x214/0x428 [ 67.330683] scsi_end_request+0x2c/0x300 [ 67.330688] scsi_io_completion+0xa0/0x710 [ 67.330695] scsi_finish_command+0xd8/0x110 [ 67.330700] scsi_softirq_done+0x114/0x148 [ 67.330708] blk_done_softirq+0x74/0xd0 [ 67.330716] __do_softirq+0x18c/0x374 [ 67.330724] irq_exit+0xb4/0xb8 [ 67.330732] __handle_domain_irq+0x84/0xc0 [ 67.330737] gic_handle_irq+0x148/0x1b0 [ 67.330744] el1_irq+0xe8/0x190 [ 67.330753] lpm_cpuidle_enter+0x4f8/0x538 [ 67.330759] cpuidle_enter_state+0x1fc/0x398 [ 67.330764] cpuidle_enter+0x18/0x20 [ 67.330772] do_idle+0x1b4/0x290 [ 67.330778] cpu_startup_entry+0x20/0x28 [ 67.330786] secondary_start_kernel+0x160/0x170
Fix this by: 1) Establishing pointers to 'struct dm_io' members in dm_io_dec_pending() so that they may be passed into end_io_acct() _after_ free_io() is called. 2) Moving end_io_acct() after free_io().
CVSS Details
- CVSS 3.1 Base Score: 4.7
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade bpftoolUpgrade kernel-tools-debuginfoUpgrade perfUpgrade kernel-headersUpgrade kernel-livepatch-4.14.281-212.502Upgrade perf-debuginfoUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-develUpgrade kernel-tools-develUpgrade kernelUpgrade kernel-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-livepatch-5.10.118-111.515Upgrade python-perf-debuginfoUpgrade python-perfUpgrade bpftool-debuginfoUpgrade kernel-tools | May 21, 2025 | May 22, 2024 |
| Debian | — | Upgrade linux | Jul 30, 2024 | May 22, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade python3-perfUpgrade kernel-toolsUpgrade kernelUpgrade kernel-abi-stablelistsUpgrade kernel-tools-libs | Oct 8, 2024 | May 22, 2024 |
| Huawei Euleros 2_0_sp9 | — | Upgrade python3-perfUpgrade kernelUpgrade kernel-toolsUpgrade kernel-tools-libs | Oct 8, 2024 | May 22, 2024 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | May 22, 2024 |
| Suse | — | Upgrade kernel-64kb-extraUpgrade kernel-source-vanillaUpgrade kernel-source-rtUpgrade dtb-nvidiaUpgrade ocfs2-kmp-defaultUpgrade kernel-default-livepatch-develUpgrade kernel-azure-baseUpgrade dtb-marvellUpgrade kernel-kvmsmall-vdsoUpgrade kernel-default-vdsoUpgrade kernel-defaultUpgrade kselftests-kmp-rtUpgrade dtb-renesasUpgrade kernel-rt_debug-develUpgrade kernel-azure-optionalUpgrade ocfs2-kmp-azureUpgrade dtb-broadcomUpgrade dtb-rockchipUpgrade kernel-default-optionalUpgrade kernel-debug-vdsoUpgrade kselftests-kmp-azureUpgrade dtb-sprdUpgrade kernel-default-base-rebuildUpgrade kernel-docs-htmlUpgrade dtb-caviumUpgrade kernel-rt-vdsoUpgrade kernel-debug-develUpgrade reiserfs-kmp-64kbUpgrade dtb-amdUpgrade reiserfs-kmp-azureUpgrade reiserfs-kmp-defaultUpgrade kernel-default-livepatchUpgrade kernel-rt-livepatchUpgrade dtb-xilinxUpgrade dtb-alteraUpgrade kernel-obs-buildUpgrade kernel-rt_debug-livepatch-develUpgrade reiserfs-kmp-rtUpgrade cluster-md-kmp-64kbUpgrade ocfs2-kmp-64kbUpgrade dlm-kmp-rtUpgrade kernel-default-baseUpgrade dlm-kmp-defaultUpgrade gfs2-kmp-defaultUpgrade kernel-rt-extraUpgrade kernel-azureUpgrade kernel-preempt-develUpgrade kernel-rt-optionalUpgrade cluster-md-kmp-rtUpgrade kernel-develUpgrade dtb-allwinnerUpgrade gfs2-kmp-azureUpgrade dtb-socionextUpgrade kernel-docsUpgrade kernel-zfcpdumpUpgrade kernel-symsUpgrade kernel-64kb-optionalUpgrade dtb-qcomUpgrade kernel-64kb-develUpgrade dtb-freescaleUpgrade kernel-preemptUpgrade kernel-azure-vdsoUpgrade dtb-appleUpgrade dtb-lgUpgrade dlm-kmp-azureUpgrade kernel-azure-develUpgrade kernel-obs-qaUpgrade kselftests-kmp-defaultUpgrade kernel-syms-rtUpgrade dtb-amazonUpgrade kernel-sourceUpgrade kernel-rt-develUpgrade dtb-mediatekUpgrade kernel-kvmsmall-develUpgrade gfs2-kmp-64kbUpgrade kernel-64kbUpgrade ocfs2-kmp-rtUpgrade dtb-amlogicUpgrade kernel-rt_debug-vdsoUpgrade dtb-exynosUpgrade cluster-md-kmp-defaultUpgrade kernel-devel-rtUpgrade kernel-macrosUpgrade kernel-default-extraUpgrade kernel-default-manUpgrade gfs2-kmp-rtUpgrade kernel-kvmsmall-livepatch-develUpgrade dtb-armUpgrade kselftests-kmp-64kbUpgrade kernel-source-azureUpgrade kernel-debug-livepatch-develUpgrade kernel-azure-extraUpgrade kernel-64kb-livepatch-develUpgrade kernel-rt_debugUpgrade kernel-rt-livepatch-develUpgrade dtb-hisiliconUpgrade kernel-rtUpgrade kernel-kvmsmallUpgrade kernel-devel-azureUpgrade kernel-default-develUpgrade kernel-azure-livepatch-develUpgrade kernel-debugUpgrade cluster-md-kmp-azureUpgrade dlm-kmp-64kbUpgrade dtb-apmUpgrade kernel-syms-azure | Aug 9, 2024 | May 22, 2024 |
| Ubuntu | — | Upgrade linux-gcp-5.4Upgrade linux-aws-hweUpgrade linux-gcp-fipsUpgrade linux-azure-fde-5.15Upgrade linux-oracleUpgrade linux-aws-fipsUpgrade linux-hweUpgrade linux-gcpUpgrade linux-ibm-5.4Upgrade linux-gkeopUpgrade linux-azure-4.15Upgrade linux-ibmUpgrade linux-gcp-4.15Upgrade linuxUpgrade linux-hwe-5.4Upgrade linux-azure-fipsUpgrade linux-bluefieldUpgrade linux-raspiUpgrade linux-azure-5.4Upgrade linux-fipsUpgrade linux-awsUpgrade linux-iotUpgrade linux-azureUpgrade linux-aws-5.4Upgrade linux-oracle-5.4Upgrade linux-kvmUpgrade linux-raspi-5.4 | Nov 19, 2024 | May 22, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | May 27, 2026 | May 22, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub