{"id":"CVE-2024-26671","revision":"db038311bae7440c9ab1ea6f7d1ded36","records":[{"revision":"db038311bae7440c9ab1ea6f7d1ded36","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2024-26671","aliases":[],"title":"blk-mq: fix IO hang from sbitmap wakeup race","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nblk-mq: fix IO hang from sbitmap wakeup race\n\nIn blk_mq_mark_tag_wait(), __add_wait_queue() may be re-ordered\nwith the following blk_mq_get_driver_tag() in case of getting driver\ntag failure.\n\nThen in __sbitmap_queue_wake_up(), waitqueue_active() may not observe\nthe added waiter in blk_mq_mark_tag_wait() and wake up nothing, meantime\nblk_mq_mark_tag_wait() can't get driver tag successfully.\n\nThis issue can be reproduced by running the following test in loop, and\nfio hang can be observed in < 30min when running it on my test VM\nin laptop.\n\n\tmodprobe -r scsi_debug\n\tmodprobe scsi_debug delay=0 dev_size_mb=4096 max_queue=1 host_max_queue=1 submit_queues=4\n\tdev=`ls -d /sys/bus/pseudo/drivers/scsi_debug/adapter*/host*/target*/*/block/* | head -1 | xargs basename`\n\tfio --filename=/dev/\"$dev\" --direct=1 --rw=randrw --bs=4k --iodepth=1 \\\n       \t\t--runtime=100 --numjobs=40 --time_based --name=test \\\n        \t--ioengine=libaio\n\nFix the issue by adding one explicit barrier in blk_mq_mark_tag_wait(), which\nis just fine in case of running out of tag.","state":0,"publishedAt":"2024-04-02T06:49:13.834+00:00","modifiedAt":"2026-10-15T00:38:25.988+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"block/blk-mq.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"da55f2cc78418dee88400aafbbaed19d7ac8188e\",\n                            \"lessThan\": \"9525b38180e2753f0daa1a522b7767a2aa969676\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"da55f2cc78418dee88400aafbbaed19d7ac8188e\",\n                            \"lessThan\": \"ecd7744a1446eb02ccc63e493e2eb6ede4ef1e10\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"da55f2cc78418dee88400aafbbaed19d7ac8188e\",\n                            \"lessThan\": \"7610ba1319253225a9ba8a9d28d472fc883b4e2f\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"da55f2cc78418dee88400aafbbaed19d7ac8188e\",\n                            \"lessThan\": \"89e0e66682e1538aeeaa3109503473663cd24c8b\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"da55f2cc78418dee88400aafbbaed19d7ac8188e\",\n                            \"lessThan\": \"1d9c777d3e70bdc57dddf7a14a80059d65919e56\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"da55f2cc78418dee88400aafbbaed19d7ac8188e\",\n                            \"lessThan\": \"6d8b01624a2540336a32be91f25187a433af53a0\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"da55f2cc78418dee88400aafbbaed19d7ac8188e\",\n                            \"lessThan\": \"f1bc0d8163f8ee84a8d5affdf624cfad657df1d2\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"da55f2cc78418dee88400aafbbaed19d7ac8188e\",\n                            \"lessThan\": \"5266caaf5660529e3da53004b8b7174cab6374ed\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"block/blk-mq.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"4.11\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"4.11\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"4.19.307\",\n                            \"lessThanOrEqual\": \"4.19.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.4.269\",\n                            \"lessThanOrEqual\": \"5.4.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.10.210\",\n                            \"lessThanOrEqual\": \"5.10.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.149\",\n                            \"lessThanOrEqual\": \"5.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.77\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.16\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.7.4\",\n                            \"lessThanOrEqual\": \"6.7.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.8\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://git.kernel.org/stable/c/9525b38180e2753f0daa1a522b7767a2aa969676","https://git.kernel.org/stable/c/ecd7744a1446eb02ccc63e493e2eb6ede4ef1e10","https://git.kernel.org/stable/c/7610ba1319253225a9ba8a9d28d472fc883b4e2f","https://git.kernel.org/stable/c/89e0e66682e1538aeeaa3109503473663cd24c8b","https://git.kernel.org/stable/c/1d9c777d3e70bdc57dddf7a14a80059d65919e56","https://git.kernel.org/stable/c/6d8b01624a2540336a32be91f25187a433af53a0","https://git.kernel.org/stable/c/f1bc0d8163f8ee84a8d5affdf624cfad657df1d2","https://git.kernel.org/stable/c/5266caaf5660529e3da53004b8b7174cab6374ed"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2024-26671","license":"CVE Program Terms of Use","key":"cve-program:CVE-2024-26671","identifiers":["CVE-2024-26671"]},"retained":false,"historicalAffected":[]}],"coverage":[]}