GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2024-46678 (GCVE-0-2024-46678)

Vulnerability from cvelistv5 – Published: 2024-09-13 05:29 – Updated: 2026-08-05 11:37
VLAI
Title
bonding: change ipsec_lock from spin lock to mutex
Summary
In the Linux kernel, the following vulnerability has been resolved: bonding: change ipsec_lock from spin lock to mutex In the cited commit, bond->ipsec_lock is added to protect ipsec_list, hence xdo_dev_state_add and xdo_dev_state_delete are called inside this lock. As ipsec_lock is a spin lock and such xfrmdev ops may sleep, "scheduling while atomic" will be triggered when changing bond's active slave. [ 101.055189] BUG: scheduling while atomic: bash/902/0x00000200 [ 101.055726] Modules linked in: [ 101.058211] CPU: 3 PID: 902 Comm: bash Not tainted 6.9.0-rc4+ #1 [ 101.058760] Hardware name: [ 101.059434] Call Trace: [ 101.059436] <TASK> [ 101.060873] dump_stack_lvl+0x51/0x60 [ 101.061275] __schedule_bug+0x4e/0x60 [ 101.061682] __schedule+0x612/0x7c0 [ 101.062078] ? __mod_timer+0x25c/0x370 [ 101.062486] schedule+0x25/0xd0 [ 101.062845] schedule_timeout+0x77/0xf0 [ 101.063265] ? asm_common_interrupt+0x22/0x40 [ 101.063724] ? __bpf_trace_itimer_state+0x10/0x10 [ 101.064215] __wait_for_common+0x87/0x190 [ 101.064648] ? usleep_range_state+0x90/0x90 [ 101.065091] cmd_exec+0x437/0xb20 [mlx5_core] [ 101.065569] mlx5_cmd_do+0x1e/0x40 [mlx5_core] [ 101.066051] mlx5_cmd_exec+0x18/0x30 [mlx5_core] [ 101.066552] mlx5_crypto_create_dek_key+0xea/0x120 [mlx5_core] [ 101.067163] ? bonding_sysfs_store_option+0x4d/0x80 [bonding] [ 101.067738] ? kmalloc_trace+0x4d/0x350 [ 101.068156] mlx5_ipsec_create_sa_ctx+0x33/0x100 [mlx5_core] [ 101.068747] mlx5e_xfrm_add_state+0x47b/0xaa0 [mlx5_core] [ 101.069312] bond_change_active_slave+0x392/0x900 [bonding] [ 101.069868] bond_option_active_slave_set+0x1c2/0x240 [bonding] [ 101.070454] __bond_opt_set+0xa6/0x430 [bonding] [ 101.070935] __bond_opt_set_notify+0x2f/0x90 [bonding] [ 101.071453] bond_opt_tryset_rtnl+0x72/0xb0 [bonding] [ 101.071965] bonding_sysfs_store_option+0x4d/0x80 [bonding] [ 101.072567] kernfs_fop_write_iter+0x10c/0x1a0 [ 101.073033] vfs_write+0x2d8/0x400 [ 101.073416] ? alloc_fd+0x48/0x180 [ 101.073798] ksys_write+0x5f/0xe0 [ 101.074175] do_syscall_64+0x52/0x110 [ 101.074576] entry_SYSCALL_64_after_hwframe+0x4b/0x53 As bond_ipsec_add_sa_all and bond_ipsec_del_sa_all are only called from bond_change_active_slave, which requires holding the RTNL lock. And bond_ipsec_add_sa and bond_ipsec_del_sa are xfrm state xdo_dev_state_add and xdo_dev_state_delete APIs, which are in user context. So ipsec_lock doesn't have to be spin lock, change it to mutex, and thus the above issue can be resolved.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-09-29 15:12 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 9a5605505d9c7dbfdb89cc29a8f5fc5cf9fd2334 , < 6b598069164ac1bb60996d6ff94e7f9169dbd2d3 (git)
Affected: 9a5605505d9c7dbfdb89cc29a8f5fc5cf9fd2334 , < 56354b0a2c24a7828eeed7de4b4dc9652d9affa3 (git)
Affected: 9a5605505d9c7dbfdb89cc29a8f5fc5cf9fd2334 , < 2aeeef906d5a526dc60cf4af92eda69836c39b1f (git)
Affected: 56ccdf868ab6010739a24a3d72c3e53fd0e1ace2 (git)
Affected: 42ec69b9cd7d1f9a8b7420807f3a5d899ca99d28 (git)
Affected: 5.10.54 , < 5.11 (semver)
Affected: 5.13.6 , < 5.14 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 5.14
Unaffected: 0 , < 5.14 (semver)
Unaffected: 6.6.49 , ≤ 6.6.* (semver)
Unaffected: 6.10.8 , ≤ 6.10.* (semver)
Unaffected: 6.11 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-46678",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-29T15:12:41.184590Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-29T15:12:56.353Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/bonding/bond_main.c",
            "include/net/bonding.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "6b598069164ac1bb60996d6ff94e7f9169dbd2d3",
              "status": "affected",
              "version": "9a5605505d9c7dbfdb89cc29a8f5fc5cf9fd2334",
              "versionType": "git"
            },
            {
              "lessThan": "56354b0a2c24a7828eeed7de4b4dc9652d9affa3",
              "status": "affected",
              "version": "9a5605505d9c7dbfdb89cc29a8f5fc5cf9fd2334",
              "versionType": "git"
            },
            {
              "lessThan": "2aeeef906d5a526dc60cf4af92eda69836c39b1f",
              "status": "affected",
              "version": "9a5605505d9c7dbfdb89cc29a8f5fc5cf9fd2334",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "56ccdf868ab6010739a24a3d72c3e53fd0e1ace2",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "42ec69b9cd7d1f9a8b7420807f3a5d899ca99d28",
              "versionType": "git"
            },
            {
              "lessThan": "5.11",
              "status": "affected",
              "version": "5.10.54",
              "versionType": "semver"
            },
            {
              "lessThan": "5.14",
              "status": "affected",
              "version": "5.13.6",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/bonding/bond_main.c",
            "include/net/bonding.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.14"
            },
            {
              "lessThan": "5.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.49",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.10.*",
              "status": "unaffected",
              "version": "6.10.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.11",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.49",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10.8",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.10.54",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.13.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbonding: change ipsec_lock from spin lock to mutex\n\nIn the cited commit, bond-\u003eipsec_lock is added to protect ipsec_list,\nhence xdo_dev_state_add and xdo_dev_state_delete are called inside\nthis lock. As ipsec_lock is a spin lock and such xfrmdev ops may sleep,\n\"scheduling while atomic\" will be triggered when changing bond\u0027s\nactive slave.\n\n[  101.055189] BUG: scheduling while atomic: bash/902/0x00000200\n[  101.055726] Modules linked in:\n[  101.058211] CPU: 3 PID: 902 Comm: bash Not tainted 6.9.0-rc4+ #1\n[  101.058760] Hardware name:\n[  101.059434] Call Trace:\n[  101.059436]  \u003cTASK\u003e\n[  101.060873]  dump_stack_lvl+0x51/0x60\n[  101.061275]  __schedule_bug+0x4e/0x60\n[  101.061682]  __schedule+0x612/0x7c0\n[  101.062078]  ? __mod_timer+0x25c/0x370\n[  101.062486]  schedule+0x25/0xd0\n[  101.062845]  schedule_timeout+0x77/0xf0\n[  101.063265]  ? asm_common_interrupt+0x22/0x40\n[  101.063724]  ? __bpf_trace_itimer_state+0x10/0x10\n[  101.064215]  __wait_for_common+0x87/0x190\n[  101.064648]  ? usleep_range_state+0x90/0x90\n[  101.065091]  cmd_exec+0x437/0xb20 [mlx5_core]\n[  101.065569]  mlx5_cmd_do+0x1e/0x40 [mlx5_core]\n[  101.066051]  mlx5_cmd_exec+0x18/0x30 [mlx5_core]\n[  101.066552]  mlx5_crypto_create_dek_key+0xea/0x120 [mlx5_core]\n[  101.067163]  ? bonding_sysfs_store_option+0x4d/0x80 [bonding]\n[  101.067738]  ? kmalloc_trace+0x4d/0x350\n[  101.068156]  mlx5_ipsec_create_sa_ctx+0x33/0x100 [mlx5_core]\n[  101.068747]  mlx5e_xfrm_add_state+0x47b/0xaa0 [mlx5_core]\n[  101.069312]  bond_change_active_slave+0x392/0x900 [bonding]\n[  101.069868]  bond_option_active_slave_set+0x1c2/0x240 [bonding]\n[  101.070454]  __bond_opt_set+0xa6/0x430 [bonding]\n[  101.070935]  __bond_opt_set_notify+0x2f/0x90 [bonding]\n[  101.071453]  bond_opt_tryset_rtnl+0x72/0xb0 [bonding]\n[  101.071965]  bonding_sysfs_store_option+0x4d/0x80 [bonding]\n[  101.072567]  kernfs_fop_write_iter+0x10c/0x1a0\n[  101.073033]  vfs_write+0x2d8/0x400\n[  101.073416]  ? alloc_fd+0x48/0x180\n[  101.073798]  ksys_write+0x5f/0xe0\n[  101.074175]  do_syscall_64+0x52/0x110\n[  101.074576]  entry_SYSCALL_64_after_hwframe+0x4b/0x53\n\nAs bond_ipsec_add_sa_all and bond_ipsec_del_sa_all are only called\nfrom bond_change_active_slave, which requires holding the RTNL lock.\nAnd bond_ipsec_add_sa and bond_ipsec_del_sa are xfrm state\nxdo_dev_state_add and xdo_dev_state_delete APIs, which are in user\ncontext. So ipsec_lock doesn\u0027t have to be spin lock, change it to\nmutex, and thus the above issue can be resolved."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable paths are entered from local configuration syscalls \u2014 xfrm netlink (`XFRM_MSG_NEWSA`/`DELSA` with `XFRMA_OFFLOAD_DEV`) and rtnetlink/sysfs writes that call `bond_change_active_slave()`. No remote peer data reaches this code; the auto-failover variant only lets an on-link party influence timing, not reach the code directly.\nAC:L - The atomic-sleep BUG is deterministic \u2014 a single active-slave change with offloaded SAs present reliably calls a sleeping `xdo_dev_state_add()` under `spin_lock_bh()`. For the RCU/UAF variant the attacker drives both sides of the race (one thread adding offloaded SAs, another enslaving/releasing the slave), so no uncontrolled condition is required.\nPR:L - Both entry points gate only on CAP_NET_ADMIN scoped to the network namespace (`netlink_net_capable()` in xfrm_user.c, netns-scoped rtnetlink/bonding options), which an unprivileged user obtains via `unshare -Urn` or holds inside a container that has a delegated offload-capable VF. Real root in the init namespace is not required.\nUI:N - The attacker performs all steps themselves \u2014 adding the offloaded xfrm state and changing the bond\u0027s active slave \u2014 with no action by any other user or administrator.\nS:U - The fault, the corrupted scheduler/lock state, and the freed objects all live in the kernel of the same host; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - Sleeping inside the RCU read-side section defeats the `synchronize_rcu()` barrier in `__bond_release_one()`, so the sleeping caller resumes on a freed `slave`/`net_device` \u2014 a use-after-free that lets a heap-sprayed replacement object be read back through the driver\u0027s SA-programming path, exposing kernel memory.\nI:H - The same use-after-free gives a write primitive: `xs-\u003exso.real_dev` and driver state are written through the stale `net_device`/`slave` allocation, and the fix\u0027s addition of `netdev_hold()`/`netdev_put()` confirms the object could be freed while still in use, which is exploitable for control-flow hijacking.\nA:H - The confirmed, trivially reproducible effect is `BUG: scheduling while atomic` with `bond-\u003eipsec_lock` held across a context switch, causing spinning CPUs, soft lockups/deadlock, and a panic under `panic_on_warn`; the use-after-free independently crashes the kernel."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:37:54.501Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/6b598069164ac1bb60996d6ff94e7f9169dbd2d3"
        },
        {
          "url": "https://git.kernel.org/stable/c/56354b0a2c24a7828eeed7de4b4dc9652d9affa3"
        },
        {
          "url": "https://git.kernel.org/stable/c/2aeeef906d5a526dc60cf4af92eda69836c39b1f"
        }
      ],
      "title": "bonding: change ipsec_lock from spin lock to mutex",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-46678",
    "datePublished": "2024-09-13T05:29:12.835Z",
    "dateReserved": "2024-09-11T15:12:18.248Z",
    "dateUpdated": "2026-08-05T11:37:54.501Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-46678",
      "date": "2026-09-16",
      "epss": "0.00174",
      "percentile": "0.07191"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.10.54\", \"versionEndExcluding\": \"5.11\", \"matchCriteriaId\": \"E8C8B6A6-E5EE-4163-A155-8D5BFD1BBC4A\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.13.6\", \"versionEndExcluding\": \"5.14\", \"matchCriteriaId\": \"3FCF5994-AD9A-4278-8BF1-BC9274834795\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.14\", \"versionEndExcluding\": \"6.6.49\", \"matchCriteriaId\": \"03EC2AFC-5CDB-45F4-A071-83D36CE1569B\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.7\", \"versionEndExcluding\": \"6.10.8\", \"matchCriteriaId\": \"1B5D46C3-56A4-4380-9309-27BF73DF29A7\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.11:rc1:*:*:*:*:*:*\", \"matchCriteriaId\": \"8B3CE743-2126-47A3-8B7C-822B502CF119\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.11:rc2:*:*:*:*:*:*\", \"matchCriteriaId\": \"4DEB27E7-30AA-45CC-8934-B89263EF3551\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.11:rc3:*:*:*:*:*:*\", \"matchCriteriaId\": \"E0005AEF-856E-47EB-BFE4-90C46899394D\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.11:rc4:*:*:*:*:*:*\", \"matchCriteriaId\": \"39889A68-6D34-47A6-82FC-CD0BF23D6754\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.11:rc5:*:*:*:*:*:*\", \"matchCriteriaId\": \"B8383ABF-1457-401F-9B61-EE50F4C61F4F\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbonding: change ipsec_lock from spin lock to mutex\\n\\nIn the cited commit, bond-\u003eipsec_lock is added to protect ipsec_list,\\nhence xdo_dev_state_add and xdo_dev_state_delete are called inside\\nthis lock. As ipsec_lock is a spin lock and such xfrmdev ops may sleep,\\n\\\"scheduling while atomic\\\" will be triggered when changing bond\u0027s\\nactive slave.\\n\\n[  101.055189] BUG: scheduling while atomic: bash/902/0x00000200\\n[  101.055726] Modules linked in:\\n[  101.058211] CPU: 3 PID: 902 Comm: bash Not tainted 6.9.0-rc4+ #1\\n[  101.058760] Hardware name:\\n[  101.059434] Call Trace:\\n[  101.059436]  \u003cTASK\u003e\\n[  101.060873]  dump_stack_lvl+0x51/0x60\\n[  101.061275]  __schedule_bug+0x4e/0x60\\n[  101.061682]  __schedule+0x612/0x7c0\\n[  101.062078]  ? __mod_timer+0x25c/0x370\\n[  101.062486]  schedule+0x25/0xd0\\n[  101.062845]  schedule_timeout+0x77/0xf0\\n[  101.063265]  ? asm_common_interrupt+0x22/0x40\\n[  101.063724]  ? __bpf_trace_itimer_state+0x10/0x10\\n[  101.064215]  __wait_for_common+0x87/0x190\\n[  101.064648]  ? usleep_range_state+0x90/0x90\\n[  101.065091]  cmd_exec+0x437/0xb20 [mlx5_core]\\n[  101.065569]  mlx5_cmd_do+0x1e/0x40 [mlx5_core]\\n[  101.066051]  mlx5_cmd_exec+0x18/0x30 [mlx5_core]\\n[  101.066552]  mlx5_crypto_create_dek_key+0xea/0x120 [mlx5_core]\\n[  101.067163]  ? bonding_sysfs_store_option+0x4d/0x80 [bonding]\\n[  101.067738]  ? kmalloc_trace+0x4d/0x350\\n[  101.068156]  mlx5_ipsec_create_sa_ctx+0x33/0x100 [mlx5_core]\\n[  101.068747]  mlx5e_xfrm_add_state+0x47b/0xaa0 [mlx5_core]\\n[  101.069312]  bond_change_active_slave+0x392/0x900 [bonding]\\n[  101.069868]  bond_option_active_slave_set+0x1c2/0x240 [bonding]\\n[  101.070454]  __bond_opt_set+0xa6/0x430 [bonding]\\n[  101.070935]  __bond_opt_set_notify+0x2f/0x90 [bonding]\\n[  101.071453]  bond_opt_tryset_rtnl+0x72/0xb0 [bonding]\\n[  101.071965]  bonding_sysfs_store_option+0x4d/0x80 [bonding]\\n[  101.072567]  kernfs_fop_write_iter+0x10c/0x1a0\\n[  101.073033]  vfs_write+0x2d8/0x400\\n[  101.073416]  ? alloc_fd+0x48/0x180\\n[  101.073798]  ksys_write+0x5f/0xe0\\n[  101.074175]  do_syscall_64+0x52/0x110\\n[  101.074576]  entry_SYSCALL_64_after_hwframe+0x4b/0x53\\n\\nAs bond_ipsec_add_sa_all and bond_ipsec_del_sa_all are only called\\nfrom bond_change_active_slave, which requires holding the RTNL lock.\\nAnd bond_ipsec_add_sa and bond_ipsec_del_sa are xfrm state\\nxdo_dev_state_add and xdo_dev_state_delete APIs, which are in user\\ncontext. So ipsec_lock doesn\u0027t have to be spin lock, change it to\\nmutex, and thus the above issue can be resolved.\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: bonding: cambiar ipsec_lock de spin lock a mutex en el commit citado, se agrega bond-\u0026gt;ipsec_lock para proteger ipsec_list, por lo tanto, se llaman xdo_dev_state_add y xdo_dev_state_delete dentro de este bloqueo. Como ipsec_lock es un spin lock y tales operaciones xfrmdev pueden dormir, se activar\\u00e1 \\\"programaci\\u00f3n mientras es at\\u00f3mica\\\" al cambiar el esclavo activo de bond. [ 101.055189] ERROR: programaci\\u00f3n mientras es at\\u00f3mica: bash/902/0x00000200 [ 101.055726] M\\u00f3dulos vinculados en: [ 101.058211] CPU: 3 PID: 902 Comm: bash No contaminado 6.9.0-rc4+ #1 [ 101.058760] Nombre del hardware: [ 101.059434] Seguimiento de llamadas: [ 101.059436]  [ 101.060873] dump_stack_lvl+0x51/0x60 [ 101.061275] __schedule_bug+0x4e/0x60 [ 101.061682] __schedule+0x612/0x7c0 [ 101.062078] ? __mod_timer+0x25c/0x370 [ 101.062486] schedule+0x25/0xd0 [ 101.062845] schedule_timeout+0x77/0xf0 [ 101.063265] ? asm_common_interrupt+0x22/0x40 [ 101.063724] ? __bpf_trace_itimer_state+0x10/0x10 [ 101.064215] __wait_for_common+0x87/0x190 [ 101.064648] ? opci\\u00f3n_almacenamiento_sysfs_bonding+0x4d/0x80 [bonding] [ 101.067738] ? kmalloc_trace+0x4d/0x350 [ 101.068156] mlx5_ipsec_create_sa_ctx+0x33/0x100 [mlx5_core] [ 101.068747] mlx5e_xfrm_add_state+0x47b/0xaa0 [mlx5_core] [ 101.069312] cambio_enlace_esclavo_activo+0x392/0x900 [enlace] [ 101.069868] opci\\u00f3n_enlace_esclavo_activo_conjunto+0x1c2/0x240 [enlace] [ 101.070454] __opci\\u00f3n_enlace_conjunto+0xa6/0x430 [enlace] [ 101.070935] __bond_opt_set_notify+0x2f/0x90 [vinculaci\\u00f3n] [ 101.071453] bond_opt_tryset_rtnl+0x72/0xb0 [vinculaci\\u00f3n] [ 101.071965] bonding_sysfs_store_option+0x4d/0x80 [vinculaci\\u00f3n] [ 101.072567] kernfs_fop_write_iter+0x10c/0x1a0 [ 101.073033] vfs_write+0x2d8/0x400 [ 101.073416] ? alloc_fd+0x48/0x180 [ 101.073798] ksys_write+0x5f/0xe0 [ 101.074175] do_syscall_64+0x52/0x110 [ 101.074576] entry_SYSCALL_64_after_hwframe+0x4b/0x53 Como bond_ipsec_add_sa_all y bond_ipsec_del_sa_all solo se llaman desde bond_change_active_slave, que requiere mantener el bloqueo RTNL. Y bond_ipsec_add_sa y bond_ipsec_del_sa son API xdo_dev_state_add y xdo_dev_state_delete de estado xfrm, que est\\u00e1n en el contexto del usuario. Por lo tanto, ipsec_lock no tiene que ser un bloqueo de giro; c\\u00e1mbielo a mutex y, por lo tanto, se puede resolver el problema anterior.\"}]",
      "id": "CVE-2024-46678",
      "lastModified": "2024-09-23T14:44:12.880",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"baseScore\": 5.5, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 3.6}]}",
      "published": "2024-09-13T06:15:12.450",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/2aeeef906d5a526dc60cf4af92eda69836c39b1f\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/56354b0a2c24a7828eeed7de4b4dc9652d9affa3\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/6b598069164ac1bb60996d6ff94e7f9169dbd2d3\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Analyzed",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-667\"}]}]"
    },
    "microsoft_vex": {
      "current_release_date": "2026-03-31T15:14:17.000Z",
      "cve": "CVE-2024-46678",
      "id": "msrc_CVE-2024-46678",
      "initial_release_date": "2024-09-01T07:00:00.000Z",
      "product_status:fixed": "2",
      "product_status:known_affected": "2",
      "product_status:under_investigation": "3",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "bonding: change ipsec_lock from spin lock to mutex",
      "url": "https://msrc.microsoft.com/csaf/vex/2024/msrc_cve-2024-46678.json",
      "version": "4"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-46678\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-09-13T06:15:12.450\",\"lastModified\":\"2026-08-04T11:20:14.227\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbonding: change ipsec_lock from spin lock to mutex\\n\\nIn the cited commit, bond-\u003eipsec_lock is added to protect ipsec_list,\\nhence xdo_dev_state_add and xdo_dev_state_delete are called inside\\nthis lock. As ipsec_lock is a spin lock and such xfrmdev ops may sleep,\\n\\\"scheduling while atomic\\\" will be triggered when changing bond\u0027s\\nactive slave.\\n\\n[  101.055189] BUG: scheduling while atomic: bash/902/0x00000200\\n[  101.055726] Modules linked in:\\n[  101.058211] CPU: 3 PID: 902 Comm: bash Not tainted 6.9.0-rc4+ #1\\n[  101.058760] Hardware name:\\n[  101.059434] Call Trace:\\n[  101.059436]  \u003cTASK\u003e\\n[  101.060873]  dump_stack_lvl+0x51/0x60\\n[  101.061275]  __schedule_bug+0x4e/0x60\\n[  101.061682]  __schedule+0x612/0x7c0\\n[  101.062078]  ? __mod_timer+0x25c/0x370\\n[  101.062486]  schedule+0x25/0xd0\\n[  101.062845]  schedule_timeout+0x77/0xf0\\n[  101.063265]  ? asm_common_interrupt+0x22/0x40\\n[  101.063724]  ? __bpf_trace_itimer_state+0x10/0x10\\n[  101.064215]  __wait_for_common+0x87/0x190\\n[  101.064648]  ? usleep_range_state+0x90/0x90\\n[  101.065091]  cmd_exec+0x437/0xb20 [mlx5_core]\\n[  101.065569]  mlx5_cmd_do+0x1e/0x40 [mlx5_core]\\n[  101.066051]  mlx5_cmd_exec+0x18/0x30 [mlx5_core]\\n[  101.066552]  mlx5_crypto_create_dek_key+0xea/0x120 [mlx5_core]\\n[  101.067163]  ? bonding_sysfs_store_option+0x4d/0x80 [bonding]\\n[  101.067738]  ? kmalloc_trace+0x4d/0x350\\n[  101.068156]  mlx5_ipsec_create_sa_ctx+0x33/0x100 [mlx5_core]\\n[  101.068747]  mlx5e_xfrm_add_state+0x47b/0xaa0 [mlx5_core]\\n[  101.069312]  bond_change_active_slave+0x392/0x900 [bonding]\\n[  101.069868]  bond_option_active_slave_set+0x1c2/0x240 [bonding]\\n[  101.070454]  __bond_opt_set+0xa6/0x430 [bonding]\\n[  101.070935]  __bond_opt_set_notify+0x2f/0x90 [bonding]\\n[  101.071453]  bond_opt_tryset_rtnl+0x72/0xb0 [bonding]\\n[  101.071965]  bonding_sysfs_store_option+0x4d/0x80 [bonding]\\n[  101.072567]  kernfs_fop_write_iter+0x10c/0x1a0\\n[  101.073033]  vfs_write+0x2d8/0x400\\n[  101.073416]  ? alloc_fd+0x48/0x180\\n[  101.073798]  ksys_write+0x5f/0xe0\\n[  101.074175]  do_syscall_64+0x52/0x110\\n[  101.074576]  entry_SYSCALL_64_after_hwframe+0x4b/0x53\\n\\nAs bond_ipsec_add_sa_all and bond_ipsec_del_sa_all are only called\\nfrom bond_change_active_slave, which requires holding the RTNL lock.\\nAnd bond_ipsec_add_sa and bond_ipsec_del_sa are xfrm state\\nxdo_dev_state_add and xdo_dev_state_delete APIs, which are in user\\ncontext. So ipsec_lock doesn\u0027t have to be spin lock, change it to\\nmutex, and thus the above issue can be resolved.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: bonding: cambiar ipsec_lock de spin lock a mutex en el commit citado, se agrega bond-\u0026gt;ipsec_lock para proteger ipsec_list, por lo tanto, se llaman xdo_dev_state_add y xdo_dev_state_delete dentro de este bloqueo. Como ipsec_lock es un spin lock y tales operaciones xfrmdev pueden dormir, se activar\u00e1 \\\"programaci\u00f3n mientras es at\u00f3mica\\\" al cambiar el esclavo activo de bond. [ 101.055189] ERROR: programaci\u00f3n mientras es at\u00f3mica: bash/902/0x00000200 [ 101.055726] M\u00f3dulos vinculados en: [ 101.058211] CPU: 3 PID: 902 Comm: bash No contaminado 6.9.0-rc4+ #1 [ 101.058760] Nombre del hardware: [ 101.059434] Seguimiento de llamadas: [ 101.059436]  [ 101.060873] dump_stack_lvl+0x51/0x60 [ 101.061275] __schedule_bug+0x4e/0x60 [ 101.061682] __schedule+0x612/0x7c0 [ 101.062078] ? __mod_timer+0x25c/0x370 [ 101.062486] schedule+0x25/0xd0 [ 101.062845] schedule_timeout+0x77/0xf0 [ 101.063265] ? asm_common_interrupt+0x22/0x40 [ 101.063724] ? __bpf_trace_itimer_state+0x10/0x10 [ 101.064215] __wait_for_common+0x87/0x190 [ 101.064648] ? opci\u00f3n_almacenamiento_sysfs_bonding+0x4d/0x80 [bonding] [ 101.067738] ? kmalloc_trace+0x4d/0x350 [ 101.068156] mlx5_ipsec_create_sa_ctx+0x33/0x100 [mlx5_core] [ 101.068747] mlx5e_xfrm_add_state+0x47b/0xaa0 [mlx5_core] [ 101.069312] cambio_enlace_esclavo_activo+0x392/0x900 [enlace] [ 101.069868] opci\u00f3n_enlace_esclavo_activo_conjunto+0x1c2/0x240 [enlace] [ 101.070454] __opci\u00f3n_enlace_conjunto+0xa6/0x430 [enlace] [ 101.070935] __bond_opt_set_notify+0x2f/0x90 [vinculaci\u00f3n] [ 101.071453] bond_opt_tryset_rtnl+0x72/0xb0 [vinculaci\u00f3n] [ 101.071965] bonding_sysfs_store_option+0x4d/0x80 [vinculaci\u00f3n] [ 101.072567] kernfs_fop_write_iter+0x10c/0x1a0 [ 101.073033] vfs_write+0x2d8/0x400 [ 101.073416] ? alloc_fd+0x48/0x180 [ 101.073798] ksys_write+0x5f/0xe0 [ 101.074175] do_syscall_64+0x52/0x110 [ 101.074576] entry_SYSCALL_64_after_hwframe+0x4b/0x53 Como bond_ipsec_add_sa_all y bond_ipsec_del_sa_all solo se llaman desde bond_change_active_slave, que requiere mantener el bloqueo RTNL. Y bond_ipsec_add_sa y bond_ipsec_del_sa son API xdo_dev_state_add y xdo_dev_state_delete de estado xfrm, que est\u00e1n en el contexto del usuario. Por lo tanto, ipsec_lock no tiene que ser un bloqueo de giro; c\u00e1mbielo a mutex y, por lo tanto, se puede resolver el problema anterior.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/net/bonding/bond_main.c\",\"include/net/bonding.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"9a5605505d9c7dbfdb89cc29a8f5fc5cf9fd2334\",\"lessThan\":\"6b598069164ac1bb60996d6ff94e7f9169dbd2d3\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"9a5605505d9c7dbfdb89cc29a8f5fc5cf9fd2334\",\"lessThan\":\"56354b0a2c24a7828eeed7de4b4dc9652d9affa3\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"9a5605505d9c7dbfdb89cc29a8f5fc5cf9fd2334\",\"lessThan\":\"2aeeef906d5a526dc60cf4af92eda69836c39b1f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"56ccdf868ab6010739a24a3d72c3e53fd0e1ace2\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"42ec69b9cd7d1f9a8b7420807f3a5d899ca99d28\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5.10.54\",\"lessThan\":\"5.11\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"5.13.6\",\"lessThan\":\"5.14\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/net/bonding/bond_main.c\",\"include/net/bonding.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.14\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.14\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.49\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.10.8\",\"lessThanOrEqual\":\"6.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.11\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-09-29T15:12:41.184590Z\",\"id\":\"CVE-2024-46678\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-667\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.10.54\",\"versionEndExcluding\":\"5.11\",\"matchCriteriaId\":\"E8C8B6A6-E5EE-4163-A155-8D5BFD1BBC4A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.13.6\",\"versionEndExcluding\":\"5.14\",\"matchCriteriaId\":\"3FCF5994-AD9A-4278-8BF1-BC9274834795\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.14\",\"versionEndExcluding\":\"6.6.49\",\"matchCriteriaId\":\"03EC2AFC-5CDB-45F4-A071-83D36CE1569B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.10.8\",\"matchCriteriaId\":\"1B5D46C3-56A4-4380-9309-27BF73DF29A7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.11:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"8B3CE743-2126-47A3-8B7C-822B502CF119\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.11:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"4DEB27E7-30AA-45CC-8934-B89263EF3551\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.11:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"E0005AEF-856E-47EB-BFE4-90C46899394D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.11:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"39889A68-6D34-47A6-82FC-CD0BF23D6754\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.11:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"B8383ABF-1457-401F-9B61-EE50F4C61F4F\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/2aeeef906d5a526dc60cf4af92eda69836c39b1f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/56354b0a2c24a7828eeed7de4b4dc9652d9affa3\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/6b598069164ac1bb60996d6ff94e7f9169dbd2d3\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-13T08:51:15+00:00",
      "cve": "CVE-2024-46678",
      "id": "CVE-2024-46678",
      "initial_release_date": "2024-09-13T00:00:00+00:00",
      "product_status:known_affected": "198",
      "product_status:known_not_affected": "76",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: bonding: change ipsec_lock from spin lock to mutex",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-46678.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-31T00:32:45Z",
      "cve": "CVE-2024-46678",
      "id": "CVE-2024-46678",
      "initial_release_date": "2024-09-14T02:51:52Z",
      "product_status:known_affected": "475",
      "product_status:known_not_affected": "242",
      "product_status:recommended": "632",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-46678",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-46678.json",
      "version": "67"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-46678\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-29T15:12:41.184590Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-29T15:12:46.047Z\"}}], \"cna\": {\"title\": \"bonding: change ipsec_lock from spin lock to mutex\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"9a5605505d9c7dbfdb89cc29a8f5fc5cf9fd2334\", \"lessThan\": \"6b598069164ac1bb60996d6ff94e7f9169dbd2d3\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"9a5605505d9c7dbfdb89cc29a8f5fc5cf9fd2334\", \"lessThan\": \"56354b0a2c24a7828eeed7de4b4dc9652d9affa3\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"9a5605505d9c7dbfdb89cc29a8f5fc5cf9fd2334\", \"lessThan\": \"2aeeef906d5a526dc60cf4af92eda69836c39b1f\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"56ccdf868ab6010739a24a3d72c3e53fd0e1ace2\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"42ec69b9cd7d1f9a8b7420807f3a5d899ca99d28\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"5.10.54\", \"lessThan\": \"5.11\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"5.13.6\", \"lessThan\": \"5.14\", \"versionType\": \"semver\"}], \"programFiles\": [\"drivers/net/bonding/bond_main.c\", \"include/net/bonding.h\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.14\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.14\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.6.49\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.10.8\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.10.*\"}, {\"status\": \"unaffected\", \"version\": \"6.11\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/net/bonding/bond_main.c\", \"include/net/bonding.h\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/6b598069164ac1bb60996d6ff94e7f9169dbd2d3\"}, {\"url\": \"https://git.kernel.org/stable/c/56354b0a2c24a7828eeed7de4b4dc9652d9affa3\"}, {\"url\": \"https://git.kernel.org/stable/c/2aeeef906d5a526dc60cf4af92eda69836c39b1f\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbonding: change ipsec_lock from spin lock to mutex\\n\\nIn the cited commit, bond-\u003eipsec_lock is added to protect ipsec_list,\\nhence xdo_dev_state_add and xdo_dev_state_delete are called inside\\nthis lock. As ipsec_lock is a spin lock and such xfrmdev ops may sleep,\\n\\\"scheduling while atomic\\\" will be triggered when changing bond\u0027s\\nactive slave.\\n\\n[  101.055189] BUG: scheduling while atomic: bash/902/0x00000200\\n[  101.055726] Modules linked in:\\n[  101.058211] CPU: 3 PID: 902 Comm: bash Not tainted 6.9.0-rc4+ #1\\n[  101.058760] Hardware name:\\n[  101.059434] Call Trace:\\n[  101.059436]  \u003cTASK\u003e\\n[  101.060873]  dump_stack_lvl+0x51/0x60\\n[  101.061275]  __schedule_bug+0x4e/0x60\\n[  101.061682]  __schedule+0x612/0x7c0\\n[  101.062078]  ? __mod_timer+0x25c/0x370\\n[  101.062486]  schedule+0x25/0xd0\\n[  101.062845]  schedule_timeout+0x77/0xf0\\n[  101.063265]  ? asm_common_interrupt+0x22/0x40\\n[  101.063724]  ? __bpf_trace_itimer_state+0x10/0x10\\n[  101.064215]  __wait_for_common+0x87/0x190\\n[  101.064648]  ? usleep_range_state+0x90/0x90\\n[  101.065091]  cmd_exec+0x437/0xb20 [mlx5_core]\\n[  101.065569]  mlx5_cmd_do+0x1e/0x40 [mlx5_core]\\n[  101.066051]  mlx5_cmd_exec+0x18/0x30 [mlx5_core]\\n[  101.066552]  mlx5_crypto_create_dek_key+0xea/0x120 [mlx5_core]\\n[  101.067163]  ? bonding_sysfs_store_option+0x4d/0x80 [bonding]\\n[  101.067738]  ? kmalloc_trace+0x4d/0x350\\n[  101.068156]  mlx5_ipsec_create_sa_ctx+0x33/0x100 [mlx5_core]\\n[  101.068747]  mlx5e_xfrm_add_state+0x47b/0xaa0 [mlx5_core]\\n[  101.069312]  bond_change_active_slave+0x392/0x900 [bonding]\\n[  101.069868]  bond_option_active_slave_set+0x1c2/0x240 [bonding]\\n[  101.070454]  __bond_opt_set+0xa6/0x430 [bonding]\\n[  101.070935]  __bond_opt_set_notify+0x2f/0x90 [bonding]\\n[  101.071453]  bond_opt_tryset_rtnl+0x72/0xb0 [bonding]\\n[  101.071965]  bonding_sysfs_store_option+0x4d/0x80 [bonding]\\n[  101.072567]  kernfs_fop_write_iter+0x10c/0x1a0\\n[  101.073033]  vfs_write+0x2d8/0x400\\n[  101.073416]  ? alloc_fd+0x48/0x180\\n[  101.073798]  ksys_write+0x5f/0xe0\\n[  101.074175]  do_syscall_64+0x52/0x110\\n[  101.074576]  entry_SYSCALL_64_after_hwframe+0x4b/0x53\\n\\nAs bond_ipsec_add_sa_all and bond_ipsec_del_sa_all are only called\\nfrom bond_change_active_slave, which requires holding the RTNL lock.\\nAnd bond_ipsec_add_sa and bond_ipsec_del_sa are xfrm state\\nxdo_dev_state_add and xdo_dev_state_delete APIs, which are in user\\ncontext. So ipsec_lock doesn\u0027t have to be spin lock, change it to\\nmutex, and thus the above issue can be resolved.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.49\", \"versionStartIncluding\": \"5.14\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.10.8\", \"versionStartIncluding\": \"5.14\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.11\", \"versionStartIncluding\": \"5.14\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"5.10.54\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"5.13.6\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-05-23T15:53:22.837Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-46678\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-05-23T15:53:22.837Z\", \"dateReserved\": \"2024-09-11T15:12:18.248Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-09-13T05:29:12.835Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.