CVE-2024-57807

What it actually does

The flaw allows a circular locking dependency between reset_mutex and scan_mutex in the megaraid_sas driver, triggering lockdep warnings and potential deadlock during concurrent reset and scan operations.

Why it matters to the business

Systems using affected Linux kernels may experience storage controller hangs or reduced availability during device management tasks, increasing downtime risk for dependent workloads until patched.

How an attack unfolds

An attacker with local access triggers concurrent SCSI reset and host scan operations to induce the mutex ordering violation; no remote or unauthenticated exploitation path is known, and listed threat actor references pertain to unrelated kernel issues.

How to fix it

Update the Linux kernel to version 5.4.289 or later; apply the equivalent fix present in all subsequent stable releases that resolved the mutex ordering.

How to confirm the fix worked

Verify the running kernel version is at or above the fixed release; reproduce the reset and scan sequence and confirm absence of circular locking warnings in the kernel log.

Typical attack path

1. Obtain local execution context on the target host
2. Trigger megaraid_sas reset while a scan_mutex operation is in progress
3. Cause circular lock acquisition leading to deadlock or warning

How to detect it

Search kernel logs and dmesg for the string 'possible circular locking dependency detected' involving reset_mutex and scan_mutex; correlate with megaraid_sas driver activity around the same timestamps.

• possible circular locking dependency detected
• lock(&instance->reset_mutex)
• lock(&shost->scan_mutex)

What your security team should do

• Prioritize kernel upgrades on systems using megaraid_sas hardware within standard change windows
• Monitor kernel logs for lockdep warnings until patches are deployed
• Review downstream package dependencies to ensure all affected distributions receive the update