CVE-2024-56641

What it actually does

Race condition in Linux kernel SMC module where close_work is flushed via cancel_work_sync before INIT_WORK is called, triggering WARN_ON(!work->func) in __flush_work during LGR termination triggered by RDMA driver removal or connection abort.

Why it matters to the business

Kernel warnings and potential connection handling instability in environments using SMC over RDMA; low operational risk but increases noise in logs and may affect reliability of high-speed networking stacks on affected kernels.

How an attack unfolds

An attacker or administrator triggers LGR termination (e.g., by unloading RDMA modules or forcing active abort) while a connection is being established; this causes smc_close_cancel_work to flush close_work before smc_close_init has run, hitting the uninitialized work warning. No privilege escalation or code execution results from the flaw itself.

How to fix it

Upgrade the Linux kernel to a version containing commit f0c37002210aaede10dae849d1a78efc2243add2 or later; rebuild and reboot with the patched kernel. No configuration workaround exists.

How to confirm the fix worked

Confirm the patch is present by checking for the early INIT_WORK call in smc_conn_create / smc_close_init paths; reproduce the original termination sequence and verify absence of the __flush_work warning.

Typical attack path

1. Unload RDMA driver or trigger smc_lgr_terminate
2. smc_conn_kill iterates conns_all and calls smc_close_active_abort
3. smc_close_cancel_work calls cancel_work_sync on uninitialized close_work
4. Kernel emits warning in __flush_work and continues

How to detect it

Search kernel logs for the exact warning string from __flush_work combined with smc_lgr_terminate_work; inspect dmesg or journalctl for traces containing smc_close_cancel_work and __cancel_work_timer around the time of RDMA module unload events.

What your security team should do

• Prioritize kernel updates on systems using SMC/RDMA within the next maintenance window
• Monitor for the specific workqueue warning in kernel logs
• Review SMC usage and consider disabling if not required to reduce attack surface