CVE-2024-27023

What it actually does

Missing percpu_ref_put on active_io in submit_flushes when flush_pending reaches zero leaves a reference held, so mddev_suspend waits indefinitely.

Why it matters to the business

MD arrays can become stuck in a state where suspend operations never complete, causing storage maintenance, shutdowns, or failover procedures to hang and disrupting availability of affected systems.

How an attack unfolds

An attacker with local access issues I/O that triggers flush submission on an md device; the unbalanced reference count prevents active_io from reaching zero, blocking subsequent suspend operations and resulting in a denial of service.

How to fix it

Apply the upstream fix (commit 6b2ff10390b19a2364af622b6666b690443f9f3f) or later stable kernels; rebuild and reboot into the patched kernel. For packaged distributions, install the vendor-supplied kernel update that contains the correction.

How to confirm the fix worked

Confirm the running kernel contains commit 6b2ff10390b19a2364af622b6666b690443f9f3f or equivalent backport; attempt md array suspend operations under flush load and verify they complete without hanging.

Typical attack path

1. Obtain local shell or user context on a system using Linux md/RAID.
2. Generate flush bio traffic against an md device (e.g., via direct I/O or filesystem operations).
3. Trigger code path that decrements flush_pending to zero without releasing active_io.
4. Invoke mddev_suspend (via array stop, reshape, or admin command) which blocks forever.

How to detect it

Search kernel logs for repeated flush-related messages or processes stuck in mddev_suspend; monitor for hung tasks involving md arrays and watch for failure of array stop or reshape commands.

What your security team should do

• Prioritize kernel updates on all systems using md/RAID within the next patching cycle.
• Monitor vendor advisories for backported fixes in distribution kernels.
• Test suspend/reshape operations in staging environments before production rollout.
• Review md device usage and consider alternative storage stacks if updates cannot be applied promptly.