{"id":"CVE-2024-27010","revision":"e11f0b4b0f60409fa83611cf33513431","records":[{"revision":"e11f0b4b0f60409fa83611cf33513431","observedAt":"2026-10-30T13:45:33.454+00:00","statement":{"source":"cve-program","id":"CVE-2024-27010","aliases":[],"title":"net/sched: Fix mirred deadlock on device recursion","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: Fix mirred deadlock on device recursion\n\nWhen the mirred action is used on a classful egress qdisc and a packet is\nmirrored or redirected to self we hit a qdisc lock deadlock.\nSee trace below.\n\n[..... other info removed for brevity....]\n[   82.890906]\n[   82.890906] ============================================\n[   82.890906] WARNING: possible recursive locking detected\n[   82.890906] 6.8.0-05205-g77fadd89fe2d-dirty #213 Tainted: G        W\n[   82.890906] --------------------------------------------\n[   82.890906] ping/418 is trying to acquire lock:\n[   82.890906] ffff888006994110 (&sch->q.lock){+.-.}-{3:3}, at:\n__dev_queue_xmit+0x1778/0x3550\n[   82.890906]\n[   82.890906] but task is already holding lock:\n[   82.890906] ffff888006994110 (&sch->q.lock){+.-.}-{3:3}, at:\n__dev_queue_xmit+0x1778/0x3550\n[   82.890906]\n[   82.890906] other info that might help us debug this:\n[   82.890906]  Possible unsafe locking scenario:\n[   82.890906]\n[   82.890906]        CPU0\n[   82.890906]        ----\n[   82.890906]   lock(&sch->q.lock);\n[   82.890906]   lock(&sch->q.lock);\n[   82.890906]\n[   82.890906]  *** DEADLOCK ***\n[   82.890906]\n[..... other info removed for brevity....]\n\nExample setup (eth0->eth0) to recreate\ntc qdisc add dev eth0 root handle 1: htb default 30\ntc filter add dev eth0 handle 1: protocol ip prio 2 matchall \\\n     action mirred egress redirect dev eth0\n\nAnother example(eth0->eth1->eth0) to recreate\ntc qdisc add dev eth0 root handle 1: htb default 30\ntc filter add dev eth0 handle 1: protocol ip prio 2 matchall \\\n     action mirred egress redirect dev eth1\n\ntc qdisc add dev eth1 root handle 1: htb default 30\ntc filter add dev eth1 handle 1: protocol ip prio 2 matchall \\\n     action mirred egress redirect dev eth0\n\nWe fix this by adding an owner field (CPU id) to struct Qdisc set after\nroot qdisc is entered. When the softirq enters it a second time, if the\nqdisc owner is the same CPU, the packet is dropped to break the loop.","state":0,"publishedAt":"2024-05-01T05:29:23.494+00:00","modifiedAt":"2026-10-30T12:18:06.388+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"include/net/sch_generic.h\",\n                        \"net/core/dev.c\",\n                        \"net/sched/sch_generic.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"e578d9c02587d57bfa7b560767c698a668a468c6\",\n                            \"lessThan\": \"09d2e807aeb8e4f2e5eac4a3064f28dcf19b9c1e\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"e578d9c02587d57bfa7b560767c698a668a468c6\",\n                            \"lessThan\": \"524323f52cbfbac4fe3f8a33a8cc405fafba0d33\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"e578d9c02587d57bfa7b560767c698a668a468c6\",\n                            \"lessThan\": \"e6b90468da4dae2281a6e381107f411efb48b0ef\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"e578d9c02587d57bfa7b560767c698a668a468c6\",\n                            \"lessThan\": \"0f022d32c3eca477fbf79a205243a6123ed0fe11\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"include/net/sch_generic.h\",\n                        \"net/core/dev.c\",\n                        \"net/sched/sch_generic.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"4.2\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"4.2\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.191\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.156\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.8.8\",\n                            \"lessThanOrEqual\": \"6.8.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.9\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://git.kernel.org/stable/c/09d2e807aeb8e4f2e5eac4a3064f28dcf19b9c1e","https://git.kernel.org/stable/c/524323f52cbfbac4fe3f8a33a8cc405fafba0d33","https://git.kernel.org/stable/c/e6b90468da4dae2281a6e381107f411efb48b0ef","https://git.kernel.org/stable/c/0f022d32c3eca477fbf79a205243a6123ed0fe11"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2024-27010","license":"CVE Program Terms of Use","key":"cve-program:CVE-2024-27010","identifiers":["CVE-2024-27010"]},"retained":false,"historicalAffected":[]}],"coverage":[]}