CWE-667
Allowed-with-ReviewImproper Locking
Abstraction: Class · Status: Draft
The product does not properly acquire or release a lock on a resource, leading to unexpected resource state changes and behaviors.
729 vulnerabilities reference this CWE, most recent first.
GHSA-2VQJ-RXH7-CHJW
Vulnerability from github – Published: 2024-04-02 09:30 – Updated: 2025-03-17 18:31In the Linux kernel, the following vulnerability has been resolved:
inet: read sk->sk_family once in inet_recv_error()
inet_recv_error() is called without holding the socket lock.
IPv6 socket could mutate to IPv4 with IPV6_ADDRFORM socket option and trigger a KCSAN warning.
{
"affected": [],
"aliases": [
"CVE-2024-26679"
],
"database_specific": {
"cwe_ids": [
"CWE-667"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-04-02T07:15:44Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\ninet: read sk-\u003esk_family once in inet_recv_error()\n\ninet_recv_error() is called without holding the socket lock.\n\nIPv6 socket could mutate to IPv4 with IPV6_ADDRFORM\nsocket option and trigger a KCSAN warning.",
"id": "GHSA-2vqj-rxh7-chjw",
"modified": "2025-03-17T18:31:38Z",
"published": "2024-04-02T09:30:41Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-26679"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/307fa8a75ab7423fa5c73573ec3d192de5027830"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/3266e638ba5cc1165f5e6989eb8c0720f1cc4b41"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/4a5e31bdd3c1702b520506d9cf8c41085f75c7f2"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/54538752216bf89ee88d47ad07802063a498c299"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/5993f121fbc01dc2d734f0ff2628009b258fb1dd"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/88081ba415224cf413101def4343d660f56d082b"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/caa064c3c2394d03e289ebd6b0be5102eb8a5b40"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/eef00a82c568944f113f2de738156ac591bbd5cd"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-2W9F-MHFG-HQ53
Vulnerability from github – Published: 2026-10-03 15:30 – Updated: 2026-10-03 15:30Nezha Dashboard from 1.8.0 before 2.3.13 contains an improper locking vulnerability where a non-deferred mutex unlock leaks on a nil-map panic path. Any authenticated non-admin member can issue four notification API calls to permanently deadlock the alerting subsystem, then exhaust memory with blocking requests.
{
"affected": [],
"aliases": [
"CVE-2026-105113"
],
"database_specific": {
"cwe_ids": [
"CWE-667"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-10-03T14:16:37Z",
"severity": "HIGH"
},
"details": "Nezha Dashboard from 1.8.0 before 2.3.13 contains an improper locking vulnerability where a non-deferred mutex unlock leaks on a nil-map panic path. Any authenticated non-admin member can issue four notification API calls to permanently deadlock the alerting subsystem, then exhaust memory with blocking requests.",
"id": "GHSA-2w9f-mhfg-hq53",
"modified": "2026-10-03T15:30:24Z",
"published": "2026-10-03T15:30:24Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/nezhahq/nezha/security/advisories/GHSA-7j7v-j77m-6g3m"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-105113"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/nezha-1.8.0-before-2.3.13-denial-of-service-via-notification-mutex-deadlock"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-2WJG-QCGR-7P52
Vulnerability from github – Published: 2024-08-21 09:31 – Updated: 2024-09-13 15:31In the Linux kernel, the following vulnerability has been resolved:
io_uring: lock overflowing for IOPOLL
syzbot reports an issue with overflow filling for IOPOLL:
WARNING: CPU: 0 PID: 28 at io_uring/io_uring.c:734 io_cqring_event_overflow+0x1c0/0x230 io_uring/io_uring.c:734 CPU: 0 PID: 28 Comm: kworker/u4:1 Not tainted 6.2.0-rc3-syzkaller-16369-g358a161a6a9e #0 Workqueue: events_unbound io_ring_exit_work Call trace: io_cqring_event_overflow+0x1c0/0x230 io_uring/io_uring.c:734 io_req_cqe_overflow+0x5c/0x70 io_uring/io_uring.c:773 io_fill_cqe_req io_uring/io_uring.h:168 [inline] io_do_iopoll+0x474/0x62c io_uring/rw.c:1065 io_iopoll_try_reap_events+0x6c/0x108 io_uring/io_uring.c:1513 io_uring_try_cancel_requests+0x13c/0x258 io_uring/io_uring.c:3056 io_ring_exit_work+0xec/0x390 io_uring/io_uring.c:2869 process_one_work+0x2d8/0x504 kernel/workqueue.c:2289 worker_thread+0x340/0x610 kernel/workqueue.c:2436 kthread+0x12c/0x158 kernel/kthread.c:376 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:863
There is no real problem for normal IOPOLL as flush is also called with uring_lock taken, but it's getting more complicated for IOPOLL|SQPOLL, for which __io_cqring_overflow_flush() happens from the CQ waiting path.
{
"affected": [],
"aliases": [
"CVE-2023-52903"
],
"database_specific": {
"cwe_ids": [
"CWE-667"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-08-21T07:15:06Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring: lock overflowing for IOPOLL\n\nsyzbot reports an issue with overflow filling for IOPOLL:\n\nWARNING: CPU: 0 PID: 28 at io_uring/io_uring.c:734 io_cqring_event_overflow+0x1c0/0x230 io_uring/io_uring.c:734\nCPU: 0 PID: 28 Comm: kworker/u4:1 Not tainted 6.2.0-rc3-syzkaller-16369-g358a161a6a9e #0\nWorkqueue: events_unbound io_ring_exit_work\nCall trace:\n\u00a0io_cqring_event_overflow+0x1c0/0x230 io_uring/io_uring.c:734\n\u00a0io_req_cqe_overflow+0x5c/0x70 io_uring/io_uring.c:773\n\u00a0io_fill_cqe_req io_uring/io_uring.h:168 [inline]\n\u00a0io_do_iopoll+0x474/0x62c io_uring/rw.c:1065\n\u00a0io_iopoll_try_reap_events+0x6c/0x108 io_uring/io_uring.c:1513\n\u00a0io_uring_try_cancel_requests+0x13c/0x258 io_uring/io_uring.c:3056\n\u00a0io_ring_exit_work+0xec/0x390 io_uring/io_uring.c:2869\n\u00a0process_one_work+0x2d8/0x504 kernel/workqueue.c:2289\n\u00a0worker_thread+0x340/0x610 kernel/workqueue.c:2436\n\u00a0kthread+0x12c/0x158 kernel/kthread.c:376\n\u00a0ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:863\n\nThere is no real problem for normal IOPOLL as flush is also called with\nuring_lock taken, but it\u0027s getting more complicated for IOPOLL|SQPOLL,\nfor which __io_cqring_overflow_flush() happens from the CQ waiting path.",
"id": "GHSA-2wjg-qcgr-7p52",
"modified": "2024-09-13T15:31:31Z",
"published": "2024-08-21T09:31:32Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-52903"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/544d163d659d45a206d8929370d5a2984e546cb7"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/7fc3990dad04a677606337ebc61964094d6cb41b"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/de77faee280163ff03b7ab64af6c9d779a43d4c4"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/ed4629d1e968359fbb91d0a3780b1e86a2c08845"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-2WX9-X824-P464
Vulnerability from github – Published: 2022-05-13 01:17 – Updated: 2022-05-13 01:17A vulnerability in the FTP inspection engine of Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of service (DoS) condition. The vulnerability exists because the affected software fails to release spinlocks when a device is running low on system memory, if the software is configured to apply FTP inspection and an access control rule to transit traffic, and the access control rule is associated with an FTP file policy. An attacker could exploit this vulnerability by sending a high rate of transit traffic through an affected device to cause a low-memory condition on the device. A successful exploit could allow the attacker to cause a software panic on the affected device, which could cause the device to reload and result in a temporary DoS condition.
{
"affected": [],
"aliases": [
"CVE-2018-15390"
],
"database_specific": {
"cwe_ids": [
"CWE-667"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-10-05T14:29:00Z",
"severity": "HIGH"
},
"details": "A vulnerability in the FTP inspection engine of Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of service (DoS) condition. The vulnerability exists because the affected software fails to release spinlocks when a device is running low on system memory, if the software is configured to apply FTP inspection and an access control rule to transit traffic, and the access control rule is associated with an FTP file policy. An attacker could exploit this vulnerability by sending a high rate of transit traffic through an affected device to cause a low-memory condition on the device. A successful exploit could allow the attacker to cause a software panic on the affected device, which could cause the device to reload and result in a temporary DoS condition.",
"id": "GHSA-2wx9-x824-p464",
"modified": "2022-05-13T01:17:45Z",
"published": "2022-05-13T01:17:45Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-15390"
},
{
"type": "WEB",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181003-ftd-inspect-dos"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/105519"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-2X7P-GC2X-3V72
Vulnerability from github – Published: 2025-07-03 09:30 – Updated: 2025-11-20 21:30In the Linux kernel, the following vulnerability has been resolved:
af_packet: move notifier's packet_dev_mc out of rcu critical section
Syzkaller reports the following issue:
BUG: sleeping function called from invalid context at kernel/locking/mutex.c:578 __mutex_lock+0x106/0xe80 kernel/locking/mutex.c:746 team_change_rx_flags+0x38/0x220 drivers/net/team/team_core.c:1781 dev_change_rx_flags net/core/dev.c:9145 [inline] __dev_set_promiscuity+0x3f8/0x590 net/core/dev.c:9189 netif_set_promiscuity+0x50/0xe0 net/core/dev.c:9201 dev_set_promiscuity+0x126/0x260 net/core/dev_api.c:286 packet_dev_mc net/packet/af_packet.c:3698 [inline] packet_dev_mclist_delete net/packet/af_packet.c:3722 [inline] packet_notifier+0x292/0xa60 net/packet/af_packet.c:4247 notifier_call_chain+0x1b3/0x3e0 kernel/notifier.c:85 call_netdevice_notifiers_extack net/core/dev.c:2214 [inline] call_netdevice_notifiers net/core/dev.c:2228 [inline] unregister_netdevice_many_notify+0x15d8/0x2330 net/core/dev.c:11972 rtnl_delete_link net/core/rtnetlink.c:3522 [inline] rtnl_dellink+0x488/0x710 net/core/rtnetlink.c:3564 rtnetlink_rcv_msg+0x7cf/0xb70 net/core/rtnetlink.c:6955 netlink_rcv_skb+0x219/0x490 net/netlink/af_netlink.c:2534
Calling PACKET_ADD_MEMBERSHIP on an ops-locked device can trigger
the NETDEV_UNREGISTER notifier, which may require disabling promiscuous
and/or allmulti mode. Both of these operations require acquiring
the netdev instance lock.
Move the call to packet_dev_mc outside of the RCU critical section.
The mclist modifications (add, del, flush, unregister) are protected by
the RTNL, not the RCU. The RCU only protects the sklist and its
associated sks. The delayed operation on the mclist entry remains
within the RTNL.
{
"affected": [],
"aliases": [
"CVE-2025-38150"
],
"database_specific": {
"cwe_ids": [
"CWE-667"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-07-03T09:15:29Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\naf_packet: move notifier\u0027s packet_dev_mc out of rcu critical section\n\nSyzkaller reports the following issue:\n\n BUG: sleeping function called from invalid context at kernel/locking/mutex.c:578\n __mutex_lock+0x106/0xe80 kernel/locking/mutex.c:746\n team_change_rx_flags+0x38/0x220 drivers/net/team/team_core.c:1781\n dev_change_rx_flags net/core/dev.c:9145 [inline]\n __dev_set_promiscuity+0x3f8/0x590 net/core/dev.c:9189\n netif_set_promiscuity+0x50/0xe0 net/core/dev.c:9201\n dev_set_promiscuity+0x126/0x260 net/core/dev_api.c:286 packet_dev_mc net/packet/af_packet.c:3698 [inline]\n packet_dev_mclist_delete net/packet/af_packet.c:3722 [inline]\n packet_notifier+0x292/0xa60 net/packet/af_packet.c:4247\n notifier_call_chain+0x1b3/0x3e0 kernel/notifier.c:85\n call_netdevice_notifiers_extack net/core/dev.c:2214 [inline]\n call_netdevice_notifiers net/core/dev.c:2228 [inline]\n unregister_netdevice_many_notify+0x15d8/0x2330 net/core/dev.c:11972\n rtnl_delete_link net/core/rtnetlink.c:3522 [inline]\n rtnl_dellink+0x488/0x710 net/core/rtnetlink.c:3564\n rtnetlink_rcv_msg+0x7cf/0xb70 net/core/rtnetlink.c:6955\n netlink_rcv_skb+0x219/0x490 net/netlink/af_netlink.c:2534\n\nCalling `PACKET_ADD_MEMBERSHIP` on an ops-locked device can trigger\nthe `NETDEV_UNREGISTER` notifier, which may require disabling promiscuous\nand/or allmulti mode. Both of these operations require acquiring\nthe netdev instance lock.\n\nMove the call to `packet_dev_mc` outside of the RCU critical section.\nThe `mclist` modifications (add, del, flush, unregister) are protected by\nthe RTNL, not the RCU. The RCU only protects the `sklist` and its\nassociated `sks`. The delayed operation on the `mclist` entry remains\nwithin the RTNL.",
"id": "GHSA-2x7p-gc2x-3v72",
"modified": "2025-11-20T21:30:30Z",
"published": "2025-07-03T09:30:34Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-38150"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/2dd4781c5af99415ebbd2f7cc763feb109863c05"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/d8d85ef0a631df9127f202e6371bb33a0b589952"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-2X9F-2VFM-PQM9
Vulnerability from github – Published: 2025-09-17 15:30 – Updated: 2025-12-12 18:30In the Linux kernel, the following vulnerability has been resolved:
led: qcom-lpg: Fix sleeping in atomic
lpg_brighness_set() function can sleep, while led's brightness_set() callback must be non-blocking. Change LPG driver to use brightness_set_blocking() instead.
BUG: sleeping function called from invalid context at kernel/locking/mutex.c:580 in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 0, name: swapper/0 preempt_count: 101, expected: 0 INFO: lockdep is turned off. CPU: 0 PID: 0 Comm: swapper/0 Tainted: G W 6.1.0-rc1-00014-gbe99b089c6fc-dirty #85 Hardware name: Qualcomm Technologies, Inc. DB820c (DT) Call trace: dump_backtrace.part.0+0xe4/0xf0 show_stack+0x18/0x40 dump_stack_lvl+0x88/0xb4 dump_stack+0x18/0x34 __might_resched+0x170/0x254 __might_sleep+0x48/0x9c __mutex_lock+0x4c/0x400 mutex_lock_nested+0x2c/0x40 lpg_brightness_single_set+0x40/0x90 led_set_brightness_nosleep+0x34/0x60 led_heartbeat_function+0x80/0x170 call_timer_fn+0xb8/0x340 __run_timers.part.0+0x20c/0x254 run_timer_softirq+0x3c/0x7c _stext+0x14c/0x578 _dosoftirq+0x10/0x20 call_on_irq_stack+0x2c/0x5c do_softirq_own_stack+0x1c/0x30 irq_exit_rcu+0x164/0x170 irq_exit_rcu+0x10/0x40 el1_interrupt+0x38/0x50 el1h_64_irq_handler+0x18/0x2c el1h_64_irq+0x64/0x68 cpuidle_enter_state+0xc8/0x380 cpuidle_enter+0x38/0x50 do_idle+0x244/0x2d0 cpu_startup_entry+0x24/0x30 rest_init+0x128/0x1a0 arch_post_acpi_subsys_init+0x0/0x18 start_kernel+0x6f4/0x734 __primary_switched+0xbc/0xc4
{
"affected": [],
"aliases": [
"CVE-2022-50371"
],
"database_specific": {
"cwe_ids": [
"CWE-667"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-09-17T15:15:36Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nled: qcom-lpg: Fix sleeping in atomic\n\nlpg_brighness_set() function can sleep, while led\u0027s brightness_set()\ncallback must be non-blocking. Change LPG driver to use\nbrightness_set_blocking() instead.\n\nBUG: sleeping function called from invalid context at kernel/locking/mutex.c:580\nin_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 0, name: swapper/0\npreempt_count: 101, expected: 0\nINFO: lockdep is turned off.\nCPU: 0 PID: 0 Comm: swapper/0 Tainted: G W 6.1.0-rc1-00014-gbe99b089c6fc-dirty #85\nHardware name: Qualcomm Technologies, Inc. DB820c (DT)\nCall trace:\n dump_backtrace.part.0+0xe4/0xf0\n show_stack+0x18/0x40\n dump_stack_lvl+0x88/0xb4\n dump_stack+0x18/0x34\n __might_resched+0x170/0x254\n __might_sleep+0x48/0x9c\n __mutex_lock+0x4c/0x400\n mutex_lock_nested+0x2c/0x40\n lpg_brightness_single_set+0x40/0x90\n led_set_brightness_nosleep+0x34/0x60\n led_heartbeat_function+0x80/0x170\n call_timer_fn+0xb8/0x340\n __run_timers.part.0+0x20c/0x254\n run_timer_softirq+0x3c/0x7c\n _stext+0x14c/0x578\n ____do_softirq+0x10/0x20\n call_on_irq_stack+0x2c/0x5c\n do_softirq_own_stack+0x1c/0x30\n __irq_exit_rcu+0x164/0x170\n irq_exit_rcu+0x10/0x40\n el1_interrupt+0x38/0x50\n el1h_64_irq_handler+0x18/0x2c\n el1h_64_irq+0x64/0x68\n cpuidle_enter_state+0xc8/0x380\n cpuidle_enter+0x38/0x50\n do_idle+0x244/0x2d0\n cpu_startup_entry+0x24/0x30\n rest_init+0x128/0x1a0\n arch_post_acpi_subsys_init+0x0/0x18\n start_kernel+0x6f4/0x734\n __primary_switched+0xbc/0xc4",
"id": "GHSA-2x9f-2vfm-pqm9",
"modified": "2025-12-12T18:30:27Z",
"published": "2025-09-17T15:30:37Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-50371"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/3031993b3474794ecb71b6f969a3e60e4bda9d8a"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/380304391fa7fb084745f26b4b9a59f4666520c1"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/9deba7b51d5ee7a2d93fabb69f9b8189241f90e3"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-32G6-M5FV-FHV6
Vulnerability from github – Published: 2025-04-01 18:30 – Updated: 2025-10-31 21:30In the Linux kernel, the following vulnerability has been resolved:
sched_ext: Fix pick_task_scx() picking non-queued tasks when it's called without balance()
a6250aa251ea ("sched_ext: Handle cases where pick_task_scx() is called without preceding balance_scx()") added a workaround to handle the cases where pick_task_scx() is called without prececing balance_scx() which is due to a fair class bug where pick_taks_fair() may return NULL after a true return from balance_fair().
The workaround detects when pick_task_scx() is called without preceding balance_scx() and emulates SCX_RQ_BAL_KEEP and triggers kicking to avoid stalling. Unfortunately, the workaround code was testing whether @prev was on SCX to decide whether to keep the task running. This is incorrect as the task may be on SCX but no longer runnable.
This could lead to a non-runnable task to be returned from pick_task_scx() which cause interesting confusions and failures. e.g. A common failure mode is the task ending up with (!on_rq && on_cpu) state which can cause potential wakers to busy loop, which can easily lead to deadlocks.
Fix it by testing whether @prev has SCX_TASK_QUEUED set. This makes @prev_on_scx only used in one place. Open code the usage and improve the comment while at it.
{
"affected": [],
"aliases": [
"CVE-2025-21897"
],
"database_specific": {
"cwe_ids": [
"CWE-667"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-04-01T16:15:20Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nsched_ext: Fix pick_task_scx() picking non-queued tasks when it\u0027s called without balance()\n\na6250aa251ea (\"sched_ext: Handle cases where pick_task_scx() is called\nwithout preceding balance_scx()\") added a workaround to handle the cases\nwhere pick_task_scx() is called without prececing balance_scx() which is due\nto a fair class bug where pick_taks_fair() may return NULL after a true\nreturn from balance_fair().\n\nThe workaround detects when pick_task_scx() is called without preceding\nbalance_scx() and emulates SCX_RQ_BAL_KEEP and triggers kicking to avoid\nstalling. Unfortunately, the workaround code was testing whether @prev was\non SCX to decide whether to keep the task running. This is incorrect as the\ntask may be on SCX but no longer runnable.\n\nThis could lead to a non-runnable task to be returned from pick_task_scx()\nwhich cause interesting confusions and failures. e.g. A common failure mode\nis the task ending up with (!on_rq \u0026\u0026 on_cpu) state which can cause\npotential wakers to busy loop, which can easily lead to deadlocks.\n\nFix it by testing whether @prev has SCX_TASK_QUEUED set. This makes\n@prev_on_scx only used in one place. Open code the usage and improve the\ncomment while at it.",
"id": "GHSA-32g6-m5fv-fhv6",
"modified": "2025-10-31T21:30:53Z",
"published": "2025-04-01T18:30:50Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-21897"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/5324c459f90d16b0c43a78b494c598915d782b7a"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/8fef0a3b17bb258130a4fcbcb5addf94b25e9ec5"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/de60a31cb0bcacfaf9487546eac5e70e0a9c66d7"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-339C-XPH3-FJ7G
Vulnerability from github – Published: 2022-05-01 07:25 – Updated: 2024-02-15 21:31The nlmclnt_mark_reclaim in clntlock.c in NFS lockd in Linux kernel before 2.6.16 allows remote attackers to cause a denial of service (process crash) and deny access to NFS exports via unspecified vectors that trigger a kernel oops (null dereference) and a deadlock.
{
"affected": [],
"aliases": [
"CVE-2006-5158"
],
"database_specific": {
"cwe_ids": [
"CWE-667"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2006-10-05T04:04:00Z",
"severity": "LOW"
},
"details": "The nlmclnt_mark_reclaim in clntlock.c in NFS lockd in Linux kernel before 2.6.16 allows remote attackers to cause a denial of service (process crash) and deny access to NFS exports via unspecified vectors that trigger a kernel oops (null dereference) and a deadlock.",
"id": "GHSA-339c-xph3-fj7g",
"modified": "2024-02-15T21:31:23Z",
"published": "2022-05-01T07:25:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2006-5158"
},
{
"type": "WEB",
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10128"
},
{
"type": "WEB",
"url": "http://marc.info/?l=linux-kernel\u0026m=113476665626446\u0026w=2"
},
{
"type": "WEB",
"url": "http://marc.info/?l=linux-kernel\u0026m=113494474208973\u0026w=2"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2007-0488.html"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/23361"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/23384"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/23752"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/25838"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/26289"
},
{
"type": "WEB",
"url": "http://support.avaya.com/elmodocs2/security/ASA-2007-287.htm"
},
{
"type": "WEB",
"url": "http://www.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=9b5b1f5bf9dcdb6f23abf65977a675eb4deba3c0"
},
{
"type": "WEB",
"url": "http://www.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=9b5b1f5bf9dcdb6f23abf65977a675eb4deba3c0"
},
{
"type": "WEB",
"url": "http://www.mandriva.com/security/advisories?name=MDKSA-2007:012"
},
{
"type": "WEB",
"url": "http://www.novell.com/linux/security/advisories/2006_57_kernel.html"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/21581"
},
{
"type": "WEB",
"url": "http://www.ubuntu.com/usn/usn-395-1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-34XG-89CF-QR7J
Vulnerability from github – Published: 2022-10-15 12:01 – Updated: 2022-10-18 12:00In camera driver, there is a possible memory corruption due to improper locking. This could lead to local denial of service in kernel.
{
"affected": [],
"aliases": [
"CVE-2022-38690"
],
"database_specific": {
"cwe_ids": [
"CWE-119",
"CWE-667",
"CWE-787"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-10-14T19:15:00Z",
"severity": "MODERATE"
},
"details": "In camera driver, there is a possible memory corruption due to improper locking. This could lead to local denial of service in kernel.",
"id": "GHSA-34xg-89cf-qr7j",
"modified": "2022-10-18T12:00:32Z",
"published": "2022-10-15T12:01:08Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-38690"
},
{
"type": "WEB",
"url": "https://www.unisoc.com/en_us/secy/announcementDetail/1575654905820020738"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-354Q-38F3-JH4J
Vulnerability from github – Published: 2023-04-25 21:30 – Updated: 2024-02-01 03:30A denial of service problem was found, due to a possible recursive locking scenario, resulting in a deadlock in table_clear in drivers/md/dm-ioctl.c in the Linux Kernel Device Mapper-Multipathing sub-component.
{
"affected": [],
"aliases": [
"CVE-2023-2269"
],
"database_specific": {
"cwe_ids": [
"CWE-413",
"CWE-667"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-04-25T21:15:10Z",
"severity": "MODERATE"
},
"details": "A denial of service problem was found, due to a possible recursive locking scenario, resulting in a deadlock in table_clear in drivers/md/dm-ioctl.c in the Linux Kernel Device Mapper-Multipathing sub-component.",
"id": "GHSA-354q-38f3-jh4j",
"modified": "2024-02-01T03:30:22Z",
"published": "2023-04-25T21:30:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-2269"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2023/07/msg00030.html"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2023/10/msg00027.html"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/63AJUCJTZCII2JMAF7MGZEM66KY7IALT"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FBLBKW2WM5YSTS6OGEU5SYHXSJ5EWSTV"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IXHBLWYNSUBS77TYPOJTADPDXKBH2F4U"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/63AJUCJTZCII2JMAF7MGZEM66KY7IALT"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FBLBKW2WM5YSTS6OGEU5SYHXSJ5EWSTV"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IXHBLWYNSUBS77TYPOJTADPDXKBH2F4U"
},
{
"type": "WEB",
"url": "https://lore.kernel.org/lkml/ZD1xyZxb3rHot8PV%40redhat.com/t"
},
{
"type": "WEB",
"url": "https://lore.kernel.org/lkml/ZD1xyZxb3rHot8PV@redhat.com/t"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20230929-0004"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2023/dsa-5448"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2023/dsa-5480"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation
Strategy: Libraries or Frameworks
Use industry standard APIs to implement locking mechanism.
CAPEC-25: Forced Deadlock
The adversary triggers and exploits a deadlock condition in the target software to cause a denial of service. A deadlock can occur when two or more competing actions are waiting for each other to finish, and thus neither ever does. Deadlock conditions can be difficult to detect.
CAPEC-26: Leveraging Race Conditions
The adversary targets a race condition occurring when multiple processes access and manipulate the same resource concurrently, and the outcome of the execution depends on the particular order in which the access takes place. The adversary can leverage a race condition by "running the race", modifying the resource and modifying the normal execution flow. For instance, a race condition can occur while accessing a file: the adversary can trick the system by replacing the original file with their version and cause the system to read the malicious file.
CAPEC-27: Leveraging Race Conditions via Symbolic Links
This attack leverages the use of symbolic links (Symlinks) in order to write to sensitive files. An attacker can create a Symlink link to a target file not otherwise accessible to them. When the privileged program tries to create a temporary file with the same name as the Symlink link, it will actually write to the target file pointed to by the attackers' Symlink link. If the attacker can insert malicious content in the temporary file they will be writing to the sensitive file by using the Symlink. The race occurs because the system checks if the temporary file exists, then creates the file. The attacker would typically create the Symlink during the interval between the check and the creation of the temporary file.