CVE-2024-26671

What it actually does

Race condition between __add_wait_queue in blk_mq_mark_tag_wait and waitqueue_active in __sbitmap_queue_wake_up allows a waiter to be missed when driver tags are exhausted, leaving the request permanently blocked and causing IO hang.

Why it matters to the business

Storage and block devices on affected Linux systems can become unresponsive under sustained load, leading to application stalls, degraded performance, and unplanned downtime on servers and virtual machines.

How an attack unfolds

An attacker or workload triggers repeated tag allocation failures while a waiter is added without proper ordering; the wakeup path then fails to observe the waiter, permanently stalling the request queue. The supplied fio reproducer with high numjobs and small queue depth reproduces the hang in under 30 minutes.

How to fix it

Update the Linux kernel to a version containing commit 9525b38180e2753f0daa1a522b7767a2aa969676 or later; rebuild and reboot with the patched kernel. Where immediate patching is not possible, limit queue depth or reduce concurrent IO jobs as a temporary mitigation.

How to confirm the fix worked

Confirm the running kernel contains commit 9525b38180e2753f0daa1a522b7767a2aa969676 via `uname -r` and `git log` on the kernel tree, then re-execute the provided fio workload to verify the hang no longer occurs.

Typical attack path

1. Mount or attach a block device using blk-mq with limited tag depth
2. Generate concurrent IO requests that exhaust available driver tags
3. Trigger the reordering between wait-queue insertion and tag-acquisition failure
4. Observe missed wakeup leaving the process blocked indefinitely

How to detect it

Review kernel logs and dmesg for repeated blk-mq tag allocation failures or hung task warnings; correlate with process traces showing processes stuck in blk_mq_get_driver_tag or io_schedule.

What your security team should do

• Prioritize kernel updates on all systems using blk-mq storage (high prevalence in servers and cloud VMs)
• Monitor for kernel updates containing the referenced commit and schedule maintenance windows before the next reboot cycle
• Add the reproducer workload to internal soak tests to validate patches