In the Linux kernel, the following vulnerability has been resolved:
block: fix deadlock between sd_remove & sd_release
Our test report the following hung task:
[ 2538.459400] INFO: task "kworker/0:0":7 blocked for more than 188 seconds. [ 2538.459427] Call trace: [ 2538.459430] __switch_to+0x174/0x338 [ 2538.459436] __schedule+0x628/0x9c4 [ 2538.459442] schedule+0x7c/0xe8 [ 2538.459447] schedule_preempt_disabled+0x24/0x40 [ 2538.459453] __mutex_lock+0x3ec/0xf04 [ 2538.459456] __mutex_lock_slowpath+0x14/0x24 [ 2538.459459] mutex_lock+0x30/0xd8 [ 2538.459462] del_gendisk+0xdc/0x350 [ 2538.459466] sd_remove+0x30/0x60 [ 2538.459470] device_release_driver_internal+0x1c4/0x2c4 [ 2538.459474] device_release_driver+0x18/0x28 [ 2538.459478] bus_remove_device+0x15c/0x174 [ 2538.459483] device_del+0x1d0/0x358 [ 2538.459488] __scsi_remove_device+0xa8/0x198 [ 2538.459493] scsi_forget_host+0x50/0x70 [ 2538.459497] scsi_remove_host+0x80/0x180 [ 2538.459502] usb_stor_disconnect+0x68/0xf4 [ 2538.459506] usb_unbind_interface+0xd4/0x280 [ 2538.459510] device_release_driver_internal+0x1c4/0x2c4 [ 2538.459514] device_release_driver+0x18/0x28 [ 2538.459518] bus_remove_device+0x15c/0x174 [ 2538.459523] device_del+0x1d0/0x358 [ 2538.459528] usb_disable_device+0x84/0x194 [ 2538.459532] usb_disconnect+0xec/0x300 [ 2538.459537] hub_event+0xb80/0x1870 [ 2538.459541] process_scheduled_works+0x248/0x4dc [ 2538.459545] worker_thread+0x244/0x334 [ 2538.459549] kthread+0x114/0x1bc
[ 2538.461001] INFO: task "fsck.":15415 blocked for more than 188 seconds. [ 2538.461014] Call trace: [ 2538.461016] __switch_to+0x174/0x338 [ 2538.461021] __schedule+0x628/0x9c4 [ 2538.461025] schedule+0x7c/0xe8 [ 2538.461030] blk_queue_enter+0xc4/0x160 [ 2538.461034] blk_mq_alloc_request+0x120/0x1d4 [ 2538.461037] scsi_execute_cmd+0x7c/0x23c [ 2538.461040] ioctl_internal_command+0x5c/0x164 [ 2538.461046] scsi_set_medium_removal+0x5c/0xb0 [ 2538.461051] sd_release+0x50/0x94 [ 2538.461054] blkdev_put+0x190/0x28c [ 2538.461058] blkdev_release+0x28/0x40 [ 2538.461063] __fput+0xf8/0x2a8 [ 2538.461066] __fput_sync+0x28/0x5c [ 2538.461070] __arm64_sys_close+0x84/0xe8 [ 2538.461073] invoke_syscall+0x58/0x114 [ 2538.461078] el0_svc_common+0xac/0xe0 [ 2538.461082] do_el0_svc+0x1c/0x28 [ 2538.461087] el0_svc+0x38/0x68 [ 2538.461090] el0t_64_sync_handler+0x68/0xbc [ 2538.461093] el0t_64_sync+0x1a8/0x1ac
T1: T2: sd_remove del_gendisk __blk_mark_disk_dead blk_freeze_queue_start ++q->mq_freeze_depth bdev_release mutex_lock(&disk->open_mutex) sd_release scsi_execute_cmd blk_queue_enter wait_event(!q->mq_freeze_depth) mutex_lock(&disk->open_mutex)
SCSI does not set GD_OWNS_QUEUE, so QUEUE_FLAG_DYING is not set in this scenario. This is a classic ABBA deadlock. To fix the deadlock, make sure we don't try to acquire disk->open_mutex after freezing the queue.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 27, 2026 | Jul 27, 2026 |
| Redhat_linux | — | Upgrade kernel-rtNo solution existsUpgrade kernel | May 15, 2025 | Aug 17, 2024 |
| Suse | — | Upgrade kernel-default-base-rebuildUpgrade kernel-docsUpgrade kselftests-kmp-defaultUpgrade kernel-rt-extraUpgrade kernel-defaultUpgrade dlm-kmp-defaultUpgrade dlm-kmp-azureUpgrade dtb-mediatekUpgrade cluster-md-kmp-defaultUpgrade kernel-default-optionalUpgrade kernel-debug-vdsoUpgrade kernel-develUpgrade dtb-rockchipUpgrade dtb-qcomUpgrade reiserfs-kmp-azureUpgrade kernel-default-baseUpgrade kernel-rt_debug-vdsoUpgrade kernel-syms-rtUpgrade kernel-rt-vdsoUpgrade ocfs2-kmp-azureUpgrade dtb-allwinnerUpgrade kernel-devel-rtUpgrade gfs2-kmp-defaultUpgrade kernel-azure-develUpgrade kernel-64kb-extraUpgrade dlm-kmp-rtUpgrade dtb-renesasUpgrade kernel-source-vanillaUpgrade dtb-armUpgrade dtb-nvidiaUpgrade cluster-md-kmp-64kbUpgrade kernel-rt-livepatch-develUpgrade kernel-azureUpgrade kernel-rtUpgrade reiserfs-kmp-rtUpgrade kernel-rt_debug-livepatch-develUpgrade kernel-obs-buildUpgrade kselftests-kmp-rtUpgrade kernel-azure-vdsoUpgrade dtb-socionextUpgrade dtb-xilinxUpgrade kernel-debug-livepatch-develUpgrade kernel-rt-develUpgrade dtb-sprdUpgrade kernel-default-livepatch-develUpgrade reiserfs-kmp-64kbUpgrade cluster-md-kmp-rtUpgrade kernel-64kb-livepatch-develUpgrade ocfs2-kmp-64kbUpgrade dtb-marvellUpgrade dtb-apmUpgrade ocfs2-kmp-rtUpgrade kernel-rt-optionalUpgrade kernel-macrosUpgrade kernel-devel-azureUpgrade kernel-azure-livepatch-develUpgrade dtb-broadcomUpgrade kernel-64kb-optionalUpgrade dtb-amdUpgrade dtb-exynosUpgrade ocfs2-kmp-defaultUpgrade kselftests-kmp-azureUpgrade kernel-rt_debugUpgrade kernel-kvmsmall-develUpgrade dtb-appleUpgrade kernel-symsUpgrade dtb-caviumUpgrade gfs2-kmp-azureUpgrade kernel-kvmsmallUpgrade kernel-default-livepatchUpgrade kernel-default-extraUpgrade dtb-freescaleUpgrade dtb-amlogicUpgrade kernel-64kb-develUpgrade kernel-64kbUpgrade kernel-default-vdsoUpgrade kernel-azure-extraUpgrade dtb-lgUpgrade kernel-kvmsmall-vdsoUpgrade dlm-kmp-64kbUpgrade dtb-hisiliconUpgrade cluster-md-kmp-azureUpgrade kernel-obs-qaUpgrade kernel-rt_debug-develUpgrade gfs2-kmp-rtUpgrade kernel-kvmsmall-livepatch-develUpgrade kernel-default-develUpgrade kernel-sourceUpgrade gfs2-kmp-64kbUpgrade kernel-docs-htmlUpgrade kernel-azure-optionalUpgrade dtb-alteraUpgrade kselftests-kmp-64kbUpgrade kernel-debug-develUpgrade dtb-amazonUpgrade kernel-syms-azureUpgrade reiserfs-kmp-defaultUpgrade kernel-source-azureUpgrade kernel-zfcpdumpUpgrade kernel-source-rtUpgrade kernel-debug | Dec 5, 2025 | Jun 3, 2025 |
| Ubuntu | — | Upgrade linux-image-virtualUpgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-oem-22.04Upgrade linux-image-6.8.0-1019-gcpUpgrade linux-image-6.8.0-1016-raspiUpgrade linux-image-nvidia-6.8Upgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-gkeopUpgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-ibm-classicUpgrade linux-image-nvidiaUpgrade linux-image-generic-lpaeUpgrade linux-image-nvidia-64k-6.8Upgrade linux-image-ibmUpgrade linux-image-genericUpgrade linux-image-oem-22.04aUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-lowlatency-hwe-24.04Upgrade linux-image-lowlatency-64k-hwe-24.04Upgrade linux-image-azure-fdeUpgrade linux-image-6.8.0-1019-nvidia-64kUpgrade linux-image-6.8.0-1017-ibmUpgrade linux-image-lowlatencyUpgrade linux-image-oracleUpgrade linux-image-6.8.0-1020-awsUpgrade linux-image-gkeop-6.8Upgrade linux-image-lowlatency-64kUpgrade linux-image-6.8.0-1018-oemUpgrade linux-image-6.8.0-50-generic-64kUpgrade linux-image-6.8.0-50-lowlatency-64kUpgrade linux-image-6.8.0-1002-gkeopUpgrade linux-image-6.8.0-1015-gkeUpgrade linux-image-6.8.0-1020-azure-fdeUpgrade linux-image-gcpUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-oem-24.04aUpgrade linux-image-6.8.0-50-lowlatencyUpgrade linux-image-virtual-hwe-22.04Upgrade linux-image-6.8.0-50-genericUpgrade linux-image-6.8.0-1017-oracle-64kUpgrade linux-image-6.8.0-1019-nvidia-lowlatency-64kUpgrade linux-image-generic-hwe-22.04Upgrade linux-image-oem-22.04dUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-nvidia-64kUpgrade linux-image-ibm-lts-24.04Upgrade linux-image-oracle-64kUpgrade linux-image-generic-64kUpgrade linux-image-6.8.0-1019-nvidiaUpgrade linux-image-6.8.0-1017-oracleUpgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-gkeUpgrade linux-image-kvmUpgrade linux-image-6.8.0-1020-azureUpgrade linux-image-raspiUpgrade linux-image-awsUpgrade linux-image-oem-22.04bUpgrade linux-image-oem-24.04Upgrade linux-image-oem-22.04cUpgrade linux-image-azureUpgrade linux-image-6.8.0-1019-nvidia-lowlatencyUpgrade linux-image-nvidia-hwe-22.04 | Dec 13, 2024 | Aug 17, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub