GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2024-26756 (GCVE-0-2024-26756)

Vulnerability from cvelistv5 – Published: 2024-04-03 17:00 – Updated: 2026-05-11 20:03
VLAI
Title
md: Don't register sync_thread for reshape directly
Summary
In the Linux kernel, the following vulnerability has been resolved: md: Don't register sync_thread for reshape directly Currently, if reshape is interrupted, then reassemble the array will register sync_thread directly from pers->run(), in this case 'MD_RECOVERY_RUNNING' is set directly, however, there is no guarantee that md_do_sync() will be executed, hence stop_sync_thread() will hang because 'MD_RECOVERY_RUNNING' can't be cleared. Last patch make sure that md_do_sync() will set MD_RECOVERY_DONE, however, following hang can still be triggered by dm-raid test shell/lvconvert-raid-reshape.sh occasionally: [root@fedora ~]# cat /proc/1982/stack [<0>] stop_sync_thread+0x1ab/0x270 [md_mod] [<0>] md_frozen_sync_thread+0x5c/0xa0 [md_mod] [<0>] raid_presuspend+0x1e/0x70 [dm_raid] [<0>] dm_table_presuspend_targets+0x40/0xb0 [dm_mod] [<0>] __dm_destroy+0x2a5/0x310 [dm_mod] [<0>] dm_destroy+0x16/0x30 [dm_mod] [<0>] dev_remove+0x165/0x290 [dm_mod] [<0>] ctl_ioctl+0x4bb/0x7b0 [dm_mod] [<0>] dm_ctl_ioctl+0x11/0x20 [dm_mod] [<0>] vfs_ioctl+0x21/0x60 [<0>] __x64_sys_ioctl+0xb9/0xe0 [<0>] do_syscall_64+0xc6/0x230 [<0>] entry_SYSCALL_64_after_hwframe+0x6c/0x74 Meanwhile mddev->recovery is: MD_RECOVERY_RUNNING | MD_RECOVERY_INTR | MD_RECOVERY_RESHAPE | MD_RECOVERY_FROZEN Fix this problem by remove the code to register sync_thread directly from raid10 and raid5. And let md_check_recovery() to register sync_thread.
Severity
No CVSS data available.
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-06-17 19:28 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: f67055780caac6a99f43834795c43acf99eba6a6 , < 13b520fb62b772e408f9b79c5fe18ad414e90417 (git)
Affected: f67055780caac6a99f43834795c43acf99eba6a6 , < ad39c08186f8a0f221337985036ba86731d6aafe (git)
guessed Create a notification for this product.
Linux Linux Affected: 2.6.17
Unaffected: 0 , < 2.6.17 (semver)
Unaffected: 6.7.7 , ≤ 6.7.* (semver)
Unaffected: 6.8 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-26756",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-17T19:28:01.094375Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-17T19:28:07.779Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T00:14:13.242Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/13b520fb62b772e408f9b79c5fe18ad414e90417"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/ad39c08186f8a0f221337985036ba86731d6aafe"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/md/md.c",
            "drivers/md/raid10.c",
            "drivers/md/raid5.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "13b520fb62b772e408f9b79c5fe18ad414e90417",
              "status": "affected",
              "version": "f67055780caac6a99f43834795c43acf99eba6a6",
              "versionType": "git"
            },
            {
              "lessThan": "ad39c08186f8a0f221337985036ba86731d6aafe",
              "status": "affected",
              "version": "f67055780caac6a99f43834795c43acf99eba6a6",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/md/md.c",
            "drivers/md/raid10.c",
            "drivers/md/raid5.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.17"
            },
            {
              "lessThan": "2.6.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.7.*",
              "status": "unaffected",
              "version": "6.7.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.8",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.7.7",
                  "versionStartIncluding": "2.6.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8",
                  "versionStartIncluding": "2.6.17",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmd: Don\u0027t register sync_thread for reshape directly\n\nCurrently, if reshape is interrupted, then reassemble the array will\nregister sync_thread directly from pers-\u003erun(), in this case\n\u0027MD_RECOVERY_RUNNING\u0027 is set directly, however, there is no guarantee\nthat md_do_sync() will be executed, hence stop_sync_thread() will hang\nbecause \u0027MD_RECOVERY_RUNNING\u0027 can\u0027t be cleared.\n\nLast patch make sure that md_do_sync() will set MD_RECOVERY_DONE,\nhowever, following hang can still be triggered by dm-raid test\nshell/lvconvert-raid-reshape.sh occasionally:\n\n[root@fedora ~]# cat /proc/1982/stack\n[\u003c0\u003e] stop_sync_thread+0x1ab/0x270 [md_mod]\n[\u003c0\u003e] md_frozen_sync_thread+0x5c/0xa0 [md_mod]\n[\u003c0\u003e] raid_presuspend+0x1e/0x70 [dm_raid]\n[\u003c0\u003e] dm_table_presuspend_targets+0x40/0xb0 [dm_mod]\n[\u003c0\u003e] __dm_destroy+0x2a5/0x310 [dm_mod]\n[\u003c0\u003e] dm_destroy+0x16/0x30 [dm_mod]\n[\u003c0\u003e] dev_remove+0x165/0x290 [dm_mod]\n[\u003c0\u003e] ctl_ioctl+0x4bb/0x7b0 [dm_mod]\n[\u003c0\u003e] dm_ctl_ioctl+0x11/0x20 [dm_mod]\n[\u003c0\u003e] vfs_ioctl+0x21/0x60\n[\u003c0\u003e] __x64_sys_ioctl+0xb9/0xe0\n[\u003c0\u003e] do_syscall_64+0xc6/0x230\n[\u003c0\u003e] entry_SYSCALL_64_after_hwframe+0x6c/0x74\n\nMeanwhile mddev-\u003erecovery is:\nMD_RECOVERY_RUNNING |\nMD_RECOVERY_INTR |\nMD_RECOVERY_RESHAPE |\nMD_RECOVERY_FROZEN\n\nFix this problem by remove the code to register sync_thread directly\nfrom raid10 and raid5. And let md_check_recovery() to register\nsync_thread."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T20:03:34.014Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/13b520fb62b772e408f9b79c5fe18ad414e90417"
        },
        {
          "url": "https://git.kernel.org/stable/c/ad39c08186f8a0f221337985036ba86731d6aafe"
        }
      ],
      "title": "md: Don\u0027t register sync_thread for reshape directly",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-26756",
    "datePublished": "2024-04-03T17:00:40.814Z",
    "dateReserved": "2024-02-19T14:20:24.170Z",
    "dateUpdated": "2026-05-11T20:03:34.014Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-26756",
      "date": "2026-09-17",
      "epss": "0.00209",
      "percentile": "0.1126"
    },
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nmd: Don\u0027t register sync_thread for reshape directly\\n\\nCurrently, if reshape is interrupted, then reassemble the array will\\nregister sync_thread directly from pers-\u003erun(), in this case\\n\u0027MD_RECOVERY_RUNNING\u0027 is set directly, however, there is no guarantee\\nthat md_do_sync() will be executed, hence stop_sync_thread() will hang\\nbecause \u0027MD_RECOVERY_RUNNING\u0027 can\u0027t be cleared.\\n\\nLast patch make sure that md_do_sync() will set MD_RECOVERY_DONE,\\nhowever, following hang can still be triggered by dm-raid test\\nshell/lvconvert-raid-reshape.sh occasionally:\\n\\n[root@fedora ~]# cat /proc/1982/stack\\n[\u003c0\u003e] stop_sync_thread+0x1ab/0x270 [md_mod]\\n[\u003c0\u003e] md_frozen_sync_thread+0x5c/0xa0 [md_mod]\\n[\u003c0\u003e] raid_presuspend+0x1e/0x70 [dm_raid]\\n[\u003c0\u003e] dm_table_presuspend_targets+0x40/0xb0 [dm_mod]\\n[\u003c0\u003e] __dm_destroy+0x2a5/0x310 [dm_mod]\\n[\u003c0\u003e] dm_destroy+0x16/0x30 [dm_mod]\\n[\u003c0\u003e] dev_remove+0x165/0x290 [dm_mod]\\n[\u003c0\u003e] ctl_ioctl+0x4bb/0x7b0 [dm_mod]\\n[\u003c0\u003e] dm_ctl_ioctl+0x11/0x20 [dm_mod]\\n[\u003c0\u003e] vfs_ioctl+0x21/0x60\\n[\u003c0\u003e] __x64_sys_ioctl+0xb9/0xe0\\n[\u003c0\u003e] do_syscall_64+0xc6/0x230\\n[\u003c0\u003e] entry_SYSCALL_64_after_hwframe+0x6c/0x74\\n\\nMeanwhile mddev-\u003erecovery is:\\nMD_RECOVERY_RUNNING |\\nMD_RECOVERY_INTR |\\nMD_RECOVERY_RESHAPE |\\nMD_RECOVERY_FROZEN\\n\\nFix this problem by remove the code to register sync_thread directly\\nfrom raid10 and raid5. And let md_check_recovery() to register\\nsync_thread.\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: md: No registre sync_thread para remodelar directamente Actualmente, si se interrumpe el proceso de remodelaci\\u00f3n, volver a ensamblar la matriz registrar\\u00e1 sync_thread directamente desde pers-\u0026gt;run(), en este caso \u0027MD_RECOVERY_RUNNING \u0027 se configura directamente, sin embargo, no hay garant\\u00eda de que md_do_sync() se ejecute, por lo tanto, stop_sync_thread() se bloquear\\u00e1 porque \u0027MD_RECOVERY_RUNNING\u0027 no se puede borrar. En el \\u00faltimo parche, aseg\\u00farese de que md_do_sync() establezca MD_RECOVERY_DONE; sin embargo, dm-raid test shell/lvconvert-raid-reshape.sh ocasionalmente puede activar el siguiente bloqueo: [root@fedora ~]# cat /proc/1982/stack [\u0026lt;0\u0026gt;] stop_sync_thread+0x1ab/0x270 [md_mod] [\u0026lt;0\u0026gt;] md_frozen_sync_thread+0x5c/0xa0 [md_mod] [\u0026lt;0\u0026gt;] raid_presuspend+0x1e/0x70 [dm_raid] [\u0026lt;0\u0026gt;] dm_table_presuspend_targets+0x40/0xb0 [ dm_mod] [\u0026lt;0\u0026gt;] __dm_destroy+0x2a5/0x310 [dm_mod] [\u0026lt;0\u0026gt;] dm_destroy+0x16/0x30 [dm_mod] [\u0026lt;0\u0026gt;] dev_remove+0x165/0x290 [dm_mod] [\u0026lt;0\u0026gt;] ctl_ioctl+0x4bb/ 0x7b0 [dm_mod] [\u0026lt;0\u0026gt;] dm_ctl_ioctl+0x11/0x20 [dm_mod] [\u0026lt;0\u0026gt;] vfs_ioctl+0x21/0x60 [\u0026lt;0\u0026gt;] __x64_sys_ioctl+0xb9/0xe0 [\u0026lt;0\u0026gt;] do_syscall_64+0xc6/0x230 [\u0026lt;0 \u0026gt;] Entry_SYSCALL_64_after_hwframe+0x6c/0x74 Mientras tanto mddev-\u0026gt;recovery es: MD_RECOVERY_RUNNING | MD_RECOVERY_INTR | MD_RECOVERY_RESHAPE | MD_RECOVERY_FROZEN Solucione este problema eliminando el c\\u00f3digo para registrar sync_thread directamente desde raid10 y raid5. Y deje que md_check_recovery() registre sync_thread.\"}]",
      "id": "CVE-2024-26756",
      "lastModified": "2024-11-21T09:03:00.037",
      "published": "2024-04-03T17:15:52.150",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/13b520fb62b772e408f9b79c5fe18ad414e90417\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/ad39c08186f8a0f221337985036ba86731d6aafe\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/13b520fb62b772e408f9b79c5fe18ad414e90417\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/ad39c08186f8a0f221337985036ba86731d6aafe\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Awaiting Analysis"
    },
    "microsoft_vex": {
      "current_release_date": "2026-08-10T14:40:51.000Z",
      "cve": "CVE-2024-26756",
      "id": "msrc_CVE-2024-26756",
      "initial_release_date": "2025-09-04T00:20:09.000Z",
      "product_status:known_affected": "22",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "md: Don\u0027t register sync_thread for reshape directly",
      "url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2024-26756.json",
      "version": "18"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-26756\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-04-03T17:15:52.150\",\"lastModified\":\"2026-06-17T07:18:15.927\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nmd: Don\u0027t register sync_thread for reshape directly\\n\\nCurrently, if reshape is interrupted, then reassemble the array will\\nregister sync_thread directly from pers-\u003erun(), in this case\\n\u0027MD_RECOVERY_RUNNING\u0027 is set directly, however, there is no guarantee\\nthat md_do_sync() will be executed, hence stop_sync_thread() will hang\\nbecause \u0027MD_RECOVERY_RUNNING\u0027 can\u0027t be cleared.\\n\\nLast patch make sure that md_do_sync() will set MD_RECOVERY_DONE,\\nhowever, following hang can still be triggered by dm-raid test\\nshell/lvconvert-raid-reshape.sh occasionally:\\n\\n[root@fedora ~]# cat /proc/1982/stack\\n[\u003c0\u003e] stop_sync_thread+0x1ab/0x270 [md_mod]\\n[\u003c0\u003e] md_frozen_sync_thread+0x5c/0xa0 [md_mod]\\n[\u003c0\u003e] raid_presuspend+0x1e/0x70 [dm_raid]\\n[\u003c0\u003e] dm_table_presuspend_targets+0x40/0xb0 [dm_mod]\\n[\u003c0\u003e] __dm_destroy+0x2a5/0x310 [dm_mod]\\n[\u003c0\u003e] dm_destroy+0x16/0x30 [dm_mod]\\n[\u003c0\u003e] dev_remove+0x165/0x290 [dm_mod]\\n[\u003c0\u003e] ctl_ioctl+0x4bb/0x7b0 [dm_mod]\\n[\u003c0\u003e] dm_ctl_ioctl+0x11/0x20 [dm_mod]\\n[\u003c0\u003e] vfs_ioctl+0x21/0x60\\n[\u003c0\u003e] __x64_sys_ioctl+0xb9/0xe0\\n[\u003c0\u003e] do_syscall_64+0xc6/0x230\\n[\u003c0\u003e] entry_SYSCALL_64_after_hwframe+0x6c/0x74\\n\\nMeanwhile mddev-\u003erecovery is:\\nMD_RECOVERY_RUNNING |\\nMD_RECOVERY_INTR |\\nMD_RECOVERY_RESHAPE |\\nMD_RECOVERY_FROZEN\\n\\nFix this problem by remove the code to register sync_thread directly\\nfrom raid10 and raid5. And let md_check_recovery() to register\\nsync_thread.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: md: No registre sync_thread para remodelar directamente Actualmente, si se interrumpe el proceso de remodelaci\u00f3n, volver a ensamblar la matriz registrar\u00e1 sync_thread directamente desde pers-\u0026gt;run(), en este caso \u0027MD_RECOVERY_RUNNING \u0027 se configura directamente, sin embargo, no hay garant\u00eda de que md_do_sync() se ejecute, por lo tanto, stop_sync_thread() se bloquear\u00e1 porque \u0027MD_RECOVERY_RUNNING\u0027 no se puede borrar. En el \u00faltimo parche, aseg\u00farese de que md_do_sync() establezca MD_RECOVERY_DONE; sin embargo, dm-raid test shell/lvconvert-raid-reshape.sh ocasionalmente puede activar el siguiente bloqueo: [root@fedora ~]# cat /proc/1982/stack [\u0026lt;0\u0026gt;] stop_sync_thread+0x1ab/0x270 [md_mod] [\u0026lt;0\u0026gt;] md_frozen_sync_thread+0x5c/0xa0 [md_mod] [\u0026lt;0\u0026gt;] raid_presuspend+0x1e/0x70 [dm_raid] [\u0026lt;0\u0026gt;] dm_table_presuspend_targets+0x40/0xb0 [ dm_mod] [\u0026lt;0\u0026gt;] __dm_destroy+0x2a5/0x310 [dm_mod] [\u0026lt;0\u0026gt;] dm_destroy+0x16/0x30 [dm_mod] [\u0026lt;0\u0026gt;] dev_remove+0x165/0x290 [dm_mod] [\u0026lt;0\u0026gt;] ctl_ioctl+0x4bb/ 0x7b0 [dm_mod] [\u0026lt;0\u0026gt;] dm_ctl_ioctl+0x11/0x20 [dm_mod] [\u0026lt;0\u0026gt;] vfs_ioctl+0x21/0x60 [\u0026lt;0\u0026gt;] __x64_sys_ioctl+0xb9/0xe0 [\u0026lt;0\u0026gt;] do_syscall_64+0xc6/0x230 [\u0026lt;0 \u0026gt;] Entry_SYSCALL_64_after_hwframe+0x6c/0x74 Mientras tanto mddev-\u0026gt;recovery es: MD_RECOVERY_RUNNING | MD_RECOVERY_INTR | MD_RECOVERY_RESHAPE | MD_RECOVERY_FROZEN Solucione este problema eliminando el c\u00f3digo para registrar sync_thread directamente desde raid10 y raid5. Y deje que md_check_recovery() registre sync_thread.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/md/md.c\",\"drivers/md/raid10.c\",\"drivers/md/raid5.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"f67055780caac6a99f43834795c43acf99eba6a6\",\"lessThan\":\"13b520fb62b772e408f9b79c5fe18ad414e90417\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f67055780caac6a99f43834795c43acf99eba6a6\",\"lessThan\":\"ad39c08186f8a0f221337985036ba86731d6aafe\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/md/md.c\",\"drivers/md/raid10.c\",\"drivers/md/raid5.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"2.6.17\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"2.6.17\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.7.7\",\"lessThanOrEqual\":\"6.7.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.8\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-06-17T19:28:01.094375Z\",\"id\":\"CVE-2024-26756\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-459\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2.6.17\",\"versionEndExcluding\":\"6.7.7\",\"matchCriteriaId\":\"4B40F459-8AC4-4B7B-A429-8F308610CEBF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.8:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"B9F4EA73-0894-400F-A490-3A397AB7A517\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.8:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"056BD938-0A27-4569-B391-30578B309EE3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.8:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"F02056A5-B362-4370-9FF8-6F0BD384D520\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.8:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"62075ACE-B2A0-4B16-829D-B3DA5AE5CC41\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.8:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"A780F817-2A77-4130-A9B7-5C25606314E3\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/13b520fb62b772e408f9b79c5fe18ad414e90417\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ad39c08186f8a0f221337985036ba86731d6aafe\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/13b520fb62b772e408f9b79c5fe18ad414e90417\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ad39c08186f8a0f221337985036ba86731d6aafe\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2025-11-21T13:41:49+00:00",
      "cve": "CVE-2024-26756",
      "id": "CVE-2024-26756",
      "initial_release_date": "2024-04-03T00:00:00+00:00",
      "product_status:known_affected": "90",
      "product_status:known_not_affected": "108",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: md: Don\u0027t register sync_thread for reshape directly",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-26756.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-01T01:13:11Z",
      "cve": "CVE-2024-26756",
      "id": "CVE-2024-26756",
      "initial_release_date": "2024-04-10T02:16:33Z",
      "product_status:known_affected": "82",
      "product_status:known_not_affected": "81",
      "product_status:recommended": "260",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-26756",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-26756.json",
      "version": "76"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/13b520fb62b772e408f9b79c5fe18ad414e90417\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/ad39c08186f8a0f221337985036ba86731d6aafe\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T00:14:13.242Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-26756\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-06-17T19:28:01.094375Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-06-17T19:28:04.987Z\"}}], \"cna\": {\"title\": \"md: Don\u0027t register sync_thread for reshape directly\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"f67055780caac6a99f43834795c43acf99eba6a6\", \"lessThan\": \"13b520fb62b772e408f9b79c5fe18ad414e90417\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"f67055780caac6a99f43834795c43acf99eba6a6\", \"lessThan\": \"ad39c08186f8a0f221337985036ba86731d6aafe\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/md/md.c\", \"drivers/md/raid10.c\", \"drivers/md/raid5.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"2.6.17\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"2.6.17\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.7.7\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.7.*\"}, {\"status\": \"unaffected\", \"version\": \"6.8\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/md/md.c\", \"drivers/md/raid10.c\", \"drivers/md/raid5.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/13b520fb62b772e408f9b79c5fe18ad414e90417\"}, {\"url\": \"https://git.kernel.org/stable/c/ad39c08186f8a0f221337985036ba86731d6aafe\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nmd: Don\u0027t register sync_thread for reshape directly\\n\\nCurrently, if reshape is interrupted, then reassemble the array will\\nregister sync_thread directly from pers-\u003erun(), in this case\\n\u0027MD_RECOVERY_RUNNING\u0027 is set directly, however, there is no guarantee\\nthat md_do_sync() will be executed, hence stop_sync_thread() will hang\\nbecause \u0027MD_RECOVERY_RUNNING\u0027 can\u0027t be cleared.\\n\\nLast patch make sure that md_do_sync() will set MD_RECOVERY_DONE,\\nhowever, following hang can still be triggered by dm-raid test\\nshell/lvconvert-raid-reshape.sh occasionally:\\n\\n[root@fedora ~]# cat /proc/1982/stack\\n[\u003c0\u003e] stop_sync_thread+0x1ab/0x270 [md_mod]\\n[\u003c0\u003e] md_frozen_sync_thread+0x5c/0xa0 [md_mod]\\n[\u003c0\u003e] raid_presuspend+0x1e/0x70 [dm_raid]\\n[\u003c0\u003e] dm_table_presuspend_targets+0x40/0xb0 [dm_mod]\\n[\u003c0\u003e] __dm_destroy+0x2a5/0x310 [dm_mod]\\n[\u003c0\u003e] dm_destroy+0x16/0x30 [dm_mod]\\n[\u003c0\u003e] dev_remove+0x165/0x290 [dm_mod]\\n[\u003c0\u003e] ctl_ioctl+0x4bb/0x7b0 [dm_mod]\\n[\u003c0\u003e] dm_ctl_ioctl+0x11/0x20 [dm_mod]\\n[\u003c0\u003e] vfs_ioctl+0x21/0x60\\n[\u003c0\u003e] __x64_sys_ioctl+0xb9/0xe0\\n[\u003c0\u003e] do_syscall_64+0xc6/0x230\\n[\u003c0\u003e] entry_SYSCALL_64_after_hwframe+0x6c/0x74\\n\\nMeanwhile mddev-\u003erecovery is:\\nMD_RECOVERY_RUNNING |\\nMD_RECOVERY_INTR |\\nMD_RECOVERY_RESHAPE |\\nMD_RECOVERY_FROZEN\\n\\nFix this problem by remove the code to register sync_thread directly\\nfrom raid10 and raid5. And let md_check_recovery() to register\\nsync_thread.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.7.7\", \"versionStartIncluding\": \"2.6.17\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.8\", \"versionStartIncluding\": \"2.6.17\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-05-11T20:03:34.014Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-26756\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-05-11T20:03:34.014Z\", \"dateReserved\": \"2024-02-19T14:20:24.170Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-04-03T17:00:40.814Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.