In the Linux kernel, the following vulnerability has been resolved:
io-wq: check for wq exit after adding new worker task_work
We check IO_WQ_BIT_EXIT before attempting to create a new worker, and wq exit cancels pending work if we have any. But it's possible to have a race between the two, where creation checks exit finding it not set, but we're in the process of exiting. The exit side will cancel pending creation task_work, but there's a gap where we add task_work after we've canceled existing creations at exit time.
Fix this by checking the EXIT bit post adding the creation task_work. If it's set, run the same cancelation that exit does.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 30, 2024 | Jun 19, 2024 |
| Suse | — | Upgrade kernel-rt-develUpgrade kernel-devel-rtUpgrade kernel-rt-extraUpgrade kernel-rt-vdsoUpgrade cluster-md-kmp-rtUpgrade kernel-rt-livepatchUpgrade kselftests-kmp-rtUpgrade kernel-rtUpgrade reiserfs-kmp-azureUpgrade dlm-kmp-azureUpgrade kernel-azureUpgrade kernel-azure-develUpgrade kernel-rt_debug-livepatch-develUpgrade dlm-kmp-rtUpgrade kernel-syms-rtUpgrade kernel-rt_debug-vdsoUpgrade kernel-azure-vdsoUpgrade kernel-rt-livepatch-develUpgrade kernel-source-rtUpgrade kernel-syms-azureUpgrade reiserfs-kmp-rtUpgrade kernel-rt_debugUpgrade kernel-azure-optionalUpgrade ocfs2-kmp-azureUpgrade ocfs2-kmp-rtUpgrade gfs2-kmp-rtUpgrade gfs2-kmp-azureUpgrade kernel-azure-extraUpgrade kernel-rt_debug-develUpgrade kernel-azure-livepatch-develUpgrade kselftests-kmp-azureUpgrade kernel-devel-azureUpgrade kernel-source-azureUpgrade kernel-rt-optionalUpgrade cluster-md-kmp-azure | Aug 9, 2024 | Jun 19, 2024 |
| Ubuntu | — | No solution existsUpgrade linux-azure-fde-5.15 | Jun 26, 2025 | Jun 19, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub