CVE-2024-36908

What it actually does

The flaw causes a spurious kernel warning in iocg_pay_debt() when an iocg is already offlined during blkcg or disk removal because the active_list emptiness check runs without first confirming offline state while iocg_waitq_timer_fn may still execute.

Why it matters to the business

Produces noisy kernel warnings and potential alert fatigue during routine storage device or cgroup removal on affected Linux systems; low urgency given absence from KEV and minimal EPSS.

How an attack unfolds

No attacker exploitation is possible; the condition is a diagnostic false-positive during normal teardown and is not reachable by external input or malicious workloads.

How to fix it

Upgrade the Linux kernel to a version containing commit 56a9d07f427378eeb75b917bb49c6fbea8204126 or apply the equivalent stable backport; rebuild and reboot affected systems.

How to confirm the fix worked

Confirm kernel source contains the added offline-state check before the active_list warning in iocg_pay_debt(); test blkcg and disk removal while monitoring dmesg for absence of the iocg_pay_debt warning.

Typical attack path

1. No attack path exists; the warning is triggered only by internal timer callbacks during legitimate blkcg or disk removal

How to detect it

Search kernel logs and dmesg for the exact warning string emitted by iocg_pay_debt during removal operations; correlate with blk-iocost timer activity preceding device teardown.

• WARNING: CPU: .* PID: .* at block/blk-iocost.c:1402 iocg_pay_debt
• iocg_pay_debt+0x14c/0x190
• iocg_waitq_timer_fn+0xd8/0x130

What your security team should do

• Prioritize kernel upgrade on systems performing frequent blkcg or device removal
• Add the fixed commit hash to internal kernel build pipelines
• Suppress or tune monitoring rules for the specific iocg_pay_debt warning until patched