CVE-2024-26775

What it actually does

Race condition allowing deadlock between bd_size_lock and device lock in the aoe block device driver when set_capacity is called while holding the device lock, enabling interrupt-unsafe lock ordering that can be triggered by concurrent configuration responses and device allocation.

Why it matters to the business

Systems using the aoe driver may experience kernel deadlocks leading to system hangs or crashes and unplanned downtime; low ecosystem prevalence and no observed exploitation reduce immediate risk but still require patching on affected kernels.

How an attack unfolds

An attacker with local access or the ability to trigger aoe configuration responses concurrently with device allocation can force the lock acquisition order that produces deadlock; the reported threat actor context does not align with this kernel locking flaw.

How to fix it

Apply the upstream fix by updating to a kernel containing commit 2499fa286fb010ceb289950050199f33c26667b9 or later stable release that moves set_capacity outside the device lock section.

How to confirm the fix worked

Verify the presence of commit 2499fa286fb010ceb289950050199f33c26667b9 in the kernel source tree or confirm that set_capacity calls occur outside the protected device lock section via code review or runtime lockdep reports.

Typical attack path

1. Trigger aoeblk_gdalloc to acquire device lock
2. Initiate concurrent set_capacity path that acquires bd_size_lock
3. From another CPU or interrupt context attempt to acquire device lock while bd_size_lock is held
4. Induce deadlock preventing further kernel progress

How to detect it

Review kernel logs for deadlock warnings involving bd_size_lock and device locks during aoe operations; examine dmesg or syslog for lockdep reports and stack traces referencing aoeblk_gdalloc or set_capacity.

What your security team should do

• Identify all systems running kernels with the aoe driver enabled
• Schedule immediate upgrade to a fixed kernel version containing the referenced commit
• Disable aoe module if not required until patching is complete
• Monitor for future Linux kernel updates addressing similar locking issues