In the Linux kernel, the following vulnerability has been resolved:
dm: fix mempool NULL pointer race when completing IO
dm_io_dec_pending() calls end_io_acct() first and will then dec md in-flight pending count. But if a task is swapping DM table at same time this can result in a crash due to mempool->elements being NULL:
task1 task2 do_resume ->do_suspend ->dm_wait_for_completion bio_endio ->clone_endio ->dm_io_dec_pending ->end_io_acct ->wakeup task1 ->dm_swap_table ->__bind ->__bind_mempools ->bioset_exit ->mempool_exit ->free_io
[ 67.330330] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 ...... [ 67.330494] pstate: 80400085 (Nzcv daIf +PAN -UAO) [ 67.330510] pc : mempool_free+0x70/0xa0 [ 67.330515] lr : mempool_free+0x4c/0xa0 [ 67.330520] sp : ffffff8008013b20 [ 67.330524] x29: ffffff8008013b20 x28: 0000000000000004 [ 67.330530] x27: ffffffa8c2ff40a0 x26: 00000000ffff1cc8 [ 67.330535] x25: 0000000000000000 x24: ffffffdada34c800 [ 67.330541] x23: 0000000000000000 x22: ffffffdada34c800 [ 67.330547] x21: 00000000ffff1cc8 x20: ffffffd9a1304d80 [ 67.330552] x19: ffffffdada34c970 x18: 000000b312625d9c [ 67.330558] x17: 00000000002dcfbf x16: 00000000000006dd [ 67.330563] x15: 000000000093b41e x14: 0000000000000010 [ 67.330569] x13: 0000000000007f7a x12: 0000000034155555 [ 67.330574] x11: 0000000000000001 x10: 0000000000000001 [ 67.330579] x9 : 0000000000000000 x8 : 0000000000000000 [ 67.330585] x7 : 0000000000000000 x6 : ffffff80148b5c1a [ 67.330590] x5 : ffffff8008013ae0 x4 : 0000000000000001 [ 67.330596] x3 : ffffff80080139c8 x2 : ffffff801083bab8 [ 67.330601] x1 : 0000000000000000 x0 : ffffffdada34c970 [ 67.330609] Call trace: [ 67.330616] mempool_free+0x70/0xa0 [ 67.330627] bio_put+0xf8/0x110 [ 67.330638] dec_pending+0x13c/0x230 [ 67.330644] clone_endio+0x90/0x180 [ 67.330649] bio_endio+0x198/0x1b8 [ 67.330655] dec_pending+0x190/0x230 [ 67.330660] clone_endio+0x90/0x180 [ 67.330665] bio_endio+0x198/0x1b8 [ 67.330673] blk_update_request+0x214/0x428 [ 67.330683] scsi_end_request+0x2c/0x300 [ 67.330688] scsi_io_completion+0xa0/0x710 [ 67.330695] scsi_finish_command+0xd8/0x110 [ 67.330700] scsi_softirq_done+0x114/0x148 [ 67.330708] blk_done_softirq+0x74/0xd0 [ 67.330716] __do_softirq+0x18c/0x374 [ 67.330724] irq_exit+0xb4/0xb8 [ 67.330732] __handle_domain_irq+0x84/0xc0 [ 67.330737] gic_handle_irq+0x148/0x1b0 [ 67.330744] el1_irq+0xe8/0x190 [ 67.330753] lpm_cpuidle_enter+0x4f8/0x538 [ 67.330759] cpuidle_enter_state+0x1fc/0x398 [ 67.330764] cpuidle_enter+0x18/0x20 [ 67.330772] do_idle+0x1b4/0x290 [ 67.330778] cpu_startup_entry+0x20/0x28 [ 67.330786] secondary_start_kernel+0x160/0x170
Fix this by: 1) Establishing pointers to 'struct dm_io' members in dm_io_dec_pending() so that they may be passed into end_io_acct() _after_ free_io() is called. 2) Moving end_io_acct() after free_io().
CVSS Details
- CVSS 3.1 Base Score: 4.7
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade kernel-toolsUpgrade python-perf-debuginfoUpgrade kernel-livepatch-5.10.118-111.515Upgrade bpftool-debuginfoUpgrade python-perfUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-tools-debuginfoUpgrade bpftoolUpgrade kernelUpgrade kernel-tools-develUpgrade kernel-develUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-headersUpgrade perfUpgrade kernel-livepatch-4.14.281-212.502Upgrade kernel-debuginfoUpgrade perf-debuginfo | May 21, 2025 | May 22, 2024 |
| Debian | — | Upgrade linux | Jul 30, 2024 | May 22, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade kernel-tools-libsUpgrade kernel-abi-stablelistsUpgrade python3-perfUpgrade kernelUpgrade kernel-tools | Oct 8, 2024 | May 22, 2024 |
| Huawei Euleros 2_0_sp9 | — | Upgrade python3-perfUpgrade kernelUpgrade kernel-toolsUpgrade kernel-tools-libs | Oct 8, 2024 | May 22, 2024 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | May 22, 2024 |
| Suse | — | Upgrade kernel-default-vdsoUpgrade dtb-allwinnerUpgrade kernel-rt-optionalUpgrade reiserfs-kmp-rtUpgrade ocfs2-kmp-64kbUpgrade dtb-rockchipUpgrade ocfs2-kmp-azureUpgrade dtb-amdUpgrade kernel-default-livepatchUpgrade kernel-debug-vdsoUpgrade kernel-source-rtUpgrade dtb-renesasUpgrade kernel-docs-htmlUpgrade reiserfs-kmp-azureUpgrade dtb-broadcomUpgrade reiserfs-kmp-64kbUpgrade ocfs2-kmp-defaultUpgrade dtb-socionextUpgrade kselftests-kmp-rtUpgrade reiserfs-kmp-defaultUpgrade cluster-md-kmp-64kbUpgrade cluster-md-kmp-rtUpgrade kselftests-kmp-azureUpgrade dlm-kmp-defaultUpgrade dtb-marvellUpgrade dtb-caviumUpgrade kernel-debug-develUpgrade dtb-alteraUpgrade kernel-azure-baseUpgrade kernel-default-livepatch-develUpgrade gfs2-kmp-azureUpgrade kernel-rt-vdsoUpgrade dtb-nvidiaUpgrade kernel-preempt-develUpgrade kernel-kvmsmall-vdsoUpgrade kernel-defaultUpgrade kernel-rt_debug-develUpgrade kernel-azureUpgrade kernel-default-optionalUpgrade kernel-rt-extraUpgrade kernel-rt-livepatchUpgrade kernel-obs-buildUpgrade kernel-azure-optionalUpgrade dtb-sprdUpgrade gfs2-kmp-defaultUpgrade kernel-develUpgrade kernel-docsUpgrade kernel-default-base-rebuildUpgrade kernel-source-vanillaUpgrade kernel-64kb-extraUpgrade dtb-xilinxUpgrade dlm-kmp-rtUpgrade kernel-rt_debug-livepatch-develUpgrade kernel-default-baseUpgrade kselftests-kmp-64kbUpgrade kernel-kvmsmall-livepatch-develUpgrade dtb-amlogicUpgrade kernel-kvmsmall-develUpgrade kernel-64kbUpgrade gfs2-kmp-64kbUpgrade kselftests-kmp-defaultUpgrade kernel-syms-rtUpgrade dtb-amazonUpgrade kernel-sourceUpgrade kernel-rt-develUpgrade dtb-mediatekUpgrade cluster-md-kmp-defaultUpgrade kernel-azure-develUpgrade kernel-zfcpdumpUpgrade kernel-64kb-livepatch-develUpgrade kernel-debug-livepatch-develUpgrade kernel-rt_debugUpgrade dtb-apmUpgrade kernel-macrosUpgrade dtb-exynosUpgrade ocfs2-kmp-rtUpgrade kernel-kvmsmallUpgrade kernel-azure-livepatch-develUpgrade kernel-64kb-optionalUpgrade kernel-obs-qaUpgrade dtb-lgUpgrade kernel-azure-vdsoUpgrade gfs2-kmp-rtUpgrade kernel-default-extraUpgrade cluster-md-kmp-azureUpgrade kernel-rt-livepatch-develUpgrade kernel-default-manUpgrade dlm-kmp-64kbUpgrade kernel-64kb-develUpgrade kernel-preemptUpgrade kernel-symsUpgrade kernel-devel-azureUpgrade kernel-default-develUpgrade kernel-rtUpgrade dtb-hisiliconUpgrade dtb-armUpgrade dtb-qcomUpgrade dtb-freescaleUpgrade kernel-syms-azureUpgrade kernel-azure-extraUpgrade kernel-debugUpgrade kernel-devel-rtUpgrade dlm-kmp-azureUpgrade dtb-appleUpgrade kernel-rt_debug-vdsoUpgrade kernel-source-azure | Aug 9, 2024 | May 22, 2024 |
| Ubuntu | — | Upgrade linux-kvmUpgrade linux-oracle-5.4Upgrade linux-raspi-5.4Upgrade linux-raspiUpgrade linux-aws-5.4Upgrade linux-fipsUpgrade linux-iotUpgrade linux-azure-5.4Upgrade linux-awsUpgrade linux-bluefieldUpgrade linux-azureUpgrade linux-gcp-fipsUpgrade linux-hweUpgrade linux-ibm-5.4Upgrade linuxUpgrade linux-gcp-5.4Upgrade linux-azure-4.15Upgrade linux-azure-fipsUpgrade linux-gkeopUpgrade linux-ibmUpgrade linux-gcp-4.15Upgrade linux-aws-fipsUpgrade linux-hwe-5.4Upgrade linux-oracleUpgrade linux-azure-fde-5.15Upgrade linux-aws-hweUpgrade linux-gcp | Nov 19, 2024 | May 22, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | May 27, 2026 | May 22, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub