CVE-2024-27005 (GCVE-0-2024-27005)

Vulnerability from cvelistv5 – Published: 2024-05-01 05:28 – Updated: 2026-08-05 11:28
VLAI
Title
interconnect: Don't access req_list while it's being manipulated
Summary
In the Linux kernel, the following vulnerability has been resolved: interconnect: Don't access req_list while it's being manipulated The icc_lock mutex was split into separate icc_lock and icc_bw_lock mutexes in [1] to avoid lockdep splats. However, this didn't adequately protect access to icc_node::req_list. The icc_set_bw() function will eventually iterate over req_list while only holding icc_bw_lock, but req_list can be modified while only holding icc_lock. This causes races between icc_set_bw(), of_icc_get(), and icc_put(). Example A: CPU0 CPU1 ---- ---- icc_set_bw(path_a) mutex_lock(&icc_bw_lock); icc_put(path_b) mutex_lock(&icc_lock); aggregate_requests() hlist_for_each_entry(r, ... hlist_del(... <r = invalid pointer> Example B: CPU0 CPU1 ---- ---- icc_set_bw(path_a) mutex_lock(&icc_bw_lock); path_b = of_icc_get() of_icc_get_by_index() mutex_lock(&icc_lock); path_find() path_init() aggregate_requests() hlist_for_each_entry(r, ... hlist_add_head(... <r = invalid pointer> Fix this by ensuring icc_bw_lock is always held before manipulating icc_node::req_list. The additional places icc_bw_lock is held don't perform any memory allocations, so we should still be safe from the original lockdep splats that motivated the separate locks. [1] commit af42269c3523 ("interconnect: Fix locking for runpm vs reclaim")
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
6.3 (Medium)
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-06-06 18:46 UTC
CWE
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 9be2957f014d91088db1eb5dd09d9a03d7184dce , < fe549d8e976300d0dd75bd904eb216bed8b145e0 (git)
Affected: ee42bfc791aa3cd78e29046f26a09d189beb3efb , < 19ec82b3cad1abef2a929262b8c1528f4e0c192d (git)
Affected: af42269c3523492d71ebbe11fefae2653e9cdc78 , < d0d04efa2e367921654b5106cc5c05e3757c2b42 (git)
Affected: af42269c3523492d71ebbe11fefae2653e9cdc78 , < 4c65507121ea8e0b47fae6d2049c8688390d46b6 (git)
Affected: af42269c3523492d71ebbe11fefae2653e9cdc78 , < de1bf25b6d771abdb52d43546cf57ad775fb68a1 (git)
Affected: 2f3a124696d43de3c837f87a9f767c56ee86cf2a (git)
Affected: 5.15.133 , < 5.15.151 (semver)
Affected: 6.1.55 , < 6.1.81 (semver)
Affected: 6.5.5 , < 6.6 (semver)
Create a notification for this product.
Linux Linux Affected: 6.6
Unaffected: 0 , < 6.6 (semver)
Unaffected: 5.15.151 , ≤ 5.15.* (semver)
Unaffected: 6.1.81 , ≤ 6.1.* (semver)
Unaffected: 6.6.29 , ≤ 6.6.* (semver)
Unaffected: 6.8.8 , ≤ 6.8.* (semver)
Unaffected: 6.9 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 6.3,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-27005",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-06T18:46:13.449387Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "description": "CWE-noinfo Not enough information",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-05T15:17:57.462Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-04T17:16:33.949Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/d0d04efa2e367921654b5106cc5c05e3757c2b42"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/4c65507121ea8e0b47fae6d2049c8688390d46b6"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/de1bf25b6d771abdb52d43546cf57ad775fb68a1"
          },
          {
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DAMSOZXJEPUOXW33WZYWCVAY7Z5S7OOY/"
          },
          {
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4EZ6PJW7VOZ224TD7N4JZNU6KV32ZJ53/"
          },
          {
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GCBZZEC7L7KTWWAS2NLJK6SO3IZIL4WW/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/interconnect/core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "fe549d8e976300d0dd75bd904eb216bed8b145e0",
              "status": "affected",
              "version": "9be2957f014d91088db1eb5dd09d9a03d7184dce",
              "versionType": "git"
            },
            {
              "lessThan": "19ec82b3cad1abef2a929262b8c1528f4e0c192d",
              "status": "affected",
              "version": "ee42bfc791aa3cd78e29046f26a09d189beb3efb",
              "versionType": "git"
            },
            {
              "lessThan": "d0d04efa2e367921654b5106cc5c05e3757c2b42",
              "status": "affected",
              "version": "af42269c3523492d71ebbe11fefae2653e9cdc78",
              "versionType": "git"
            },
            {
              "lessThan": "4c65507121ea8e0b47fae6d2049c8688390d46b6",
              "status": "affected",
              "version": "af42269c3523492d71ebbe11fefae2653e9cdc78",
              "versionType": "git"
            },
            {
              "lessThan": "de1bf25b6d771abdb52d43546cf57ad775fb68a1",
              "status": "affected",
              "version": "af42269c3523492d71ebbe11fefae2653e9cdc78",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "2f3a124696d43de3c837f87a9f767c56ee86cf2a",
              "versionType": "git"
            },
            {
              "lessThan": "5.15.151",
              "status": "affected",
              "version": "5.15.133",
              "versionType": "semver"
            },
            {
              "lessThan": "6.1.81",
              "status": "affected",
              "version": "6.1.55",
              "versionType": "semver"
            },
            {
              "lessThan": "6.6",
              "status": "affected",
              "version": "6.5.5",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/interconnect/core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.6"
            },
            {
              "lessThan": "6.6",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.151",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.81",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.29",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.8.*",
              "status": "unaffected",
              "version": "6.8.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.9",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.151",
                  "versionStartIncluding": "5.15.133",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.81",
                  "versionStartIncluding": "6.1.55",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.29",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8.8",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.5.5",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ninterconnect: Don\u0027t access req_list while it\u0027s being manipulated\n\nThe icc_lock mutex was split into separate icc_lock and icc_bw_lock\nmutexes in [1] to avoid lockdep splats. However, this didn\u0027t adequately\nprotect access to icc_node::req_list.\n\nThe icc_set_bw() function will eventually iterate over req_list while\nonly holding icc_bw_lock, but req_list can be modified while only\nholding icc_lock. This causes races between icc_set_bw(), of_icc_get(),\nand icc_put().\n\nExample A:\n\n  CPU0                               CPU1\n  ----                               ----\n  icc_set_bw(path_a)\n    mutex_lock(\u0026icc_bw_lock);\n                                     icc_put(path_b)\n                                       mutex_lock(\u0026icc_lock);\n    aggregate_requests()\n      hlist_for_each_entry(r, ...\n                                       hlist_del(...\n        \u003cr = invalid pointer\u003e\n\nExample B:\n\n  CPU0                               CPU1\n  ----                               ----\n  icc_set_bw(path_a)\n    mutex_lock(\u0026icc_bw_lock);\n                                     path_b = of_icc_get()\n                                       of_icc_get_by_index()\n                                         mutex_lock(\u0026icc_lock);\n                                         path_find()\n                                           path_init()\n    aggregate_requests()\n      hlist_for_each_entry(r, ...\n                                             hlist_add_head(...\n        \u003cr = invalid pointer\u003e\n\nFix this by ensuring icc_bw_lock is always held before manipulating\nicc_node::req_list. The additional places icc_bw_lock is held don\u0027t\nperform any memory allocations, so we should still be safe from the\noriginal lockdep splats that motivated the separate locks.\n\n[1] commit af42269c3523 (\"interconnect: Fix locking for runpm vs reclaim\")"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The interconnect framework is reached only through local syscall paths \u2014 V4L2 ioctls on /dev/videoN (venus), DRM render-node submissions driving GPU devfreq, block I/O driving UFS/eMMC clock scaling \u2014 all of which require local access to the device. No network-facing protocol handler reaches `icc_set_bw()` or `icc_put()`.\nAC:L - The attacker directly controls the reading side of the race and can spin it in a tight loop (repeated `VIDIOC_STREAMON`/`STREAMOFF` on /dev/videoN, or continuous GPU/IO load forcing OPP bandwidth transitions), so the `req_list` walk in `aggregate_requests()` can be issued arbitrarily often against recurring `path_init()`/`icc_put()` mutations, with unlimited retries and no condition outside the attacker\u0027s influence gating success.\nPR:L - An ordinary unprivileged local account suffices \u2014 access to /dev/videoN (video/media group, or any app on Android), /dev/dri/renderD128, or simply generating filesystem I/O is enough to drive `icc_set_bw()` into `aggregate_requests()`. No capability, root, or namespace privilege is required.\nUI:N - The attacker\u0027s own process triggers both the bandwidth-vote storm and the racing condition entirely on its own. No victim action, no file to open, no filesystem to mount.\nS:U - The corruption is confined to kernel heap objects and interconnect provider state within the same kernel security authority. There is no VM, IOMMU, or sandbox boundary crossed.\nC:H - The list walk continues through a `kfree()`d `struct icc_path` from a general-purpose kmalloc cache, so a sprayed `req_node.next` steers subsequent iterations to arbitrary kernel addresses, reading `enabled`/`tag`/`avg_bw`/`peak_bw` from them; those values surface in `node-\u003eavg_bw`/`peak_bw`, giving a use-after-free based arbitrary-read primitive.\nI:H - This is a use-after-free plus hlist corruption on a `GFP_KERNEL` kmalloc object, which is a standard heap-spray and write-primitive foundation; concretely, garbage read from freed memory is aggregated into `node-\u003eavg_bw`/`peak_bw` and programmed into interconnect hardware through `apply_constraints()` \u2192 `p-\u003eset()`, corrupting system bus configuration.\nA:H - `icc_put()` uses `hlist_del()` (leaving `LIST_POISON1` in `next`) immediately followed by `kfree(path)`, so a racing `hlist_for_each_entry()` dereferences a poison or dangling pointer and oopses/panics the kernel; `hlist_add_head()` racing the same walk can likewise send it into a corrupted chain."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:28:55.925Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/fe549d8e976300d0dd75bd904eb216bed8b145e0"
        },
        {
          "url": "https://git.kernel.org/stable/c/19ec82b3cad1abef2a929262b8c1528f4e0c192d"
        },
        {
          "url": "https://git.kernel.org/stable/c/d0d04efa2e367921654b5106cc5c05e3757c2b42"
        },
        {
          "url": "https://git.kernel.org/stable/c/4c65507121ea8e0b47fae6d2049c8688390d46b6"
        },
        {
          "url": "https://git.kernel.org/stable/c/de1bf25b6d771abdb52d43546cf57ad775fb68a1"
        }
      ],
      "title": "interconnect: Don\u0027t access req_list while it\u0027s being manipulated",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-27005",
    "datePublished": "2024-05-01T05:28:59.193Z",
    "dateReserved": "2024-02-19T14:20:24.207Z",
    "dateUpdated": "2026-08-05T11:28:55.925Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-27005",
      "date": "2026-10-08",
      "epss": "0.00181",
      "percentile": "0.07026"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/interconnect/core.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "fe549d8e976300d0dd75bd904eb216bed8b145e0",
                    "status": "affected",
                    "version": "9be2957f014d91088db1eb5dd09d9a03d7184dce",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "19ec82b3cad1abef2a929262b8c1528f4e0c192d",
                    "status": "affected",
                    "version": "ee42bfc791aa3cd78e29046f26a09d189beb3efb",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "d0d04efa2e367921654b5106cc5c05e3757c2b42",
                    "status": "affected",
                    "version": "af42269c3523492d71ebbe11fefae2653e9cdc78",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "4c65507121ea8e0b47fae6d2049c8688390d46b6",
                    "status": "affected",
                    "version": "af42269c3523492d71ebbe11fefae2653e9cdc78",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "de1bf25b6d771abdb52d43546cf57ad775fb68a1",
                    "status": "affected",
                    "version": "af42269c3523492d71ebbe11fefae2653e9cdc78",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "2f3a124696d43de3c837f87a9f767c56ee86cf2a",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "5.15.151",
                    "status": "affected",
                    "version": "5.15.133",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "6.1.81",
                    "status": "affected",
                    "version": "6.1.55",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "6.6",
                    "status": "affected",
                    "version": "6.5.5",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/interconnect/core.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.6"
                  },
                  {
                    "lessThan": "6.6",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.151",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.81",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.29",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.8.*",
                    "status": "unaffected",
                    "version": "6.8.8",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.9",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "6D0A76D9-EE74-4B8A-92A4-1C7A0FDFC283",
                    "versionEndExcluding": "5.16",
                    "versionStartIncluding": "5.15.133",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "05A2D702-83B6-45D3-8690-6E4FF01F5E75",
                    "versionEndExcluding": "6.2",
                    "versionStartIncluding": "6.1.55",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "68E16AD4-0EF2-4134-8518-29A29136A800",
                    "versionEndExcluding": "6.6.29",
                    "versionStartIncluding": "6.5.5",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "673B3328-389D-41A4-9617-669298635262",
                    "versionEndExcluding": "6.8.8",
                    "versionStartIncluding": "6.7",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.9:rc1:*:*:*:*:*:*",
                    "matchCriteriaId": "22BEDD49-2C6D-402D-9DBF-6646F6ECD10B",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.9:rc2:*:*:*:*:*:*",
                    "matchCriteriaId": "DF73CB2A-DFFD-46FB-9BFE-AA394F27EA37",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.9:rc3:*:*:*:*:*:*",
                    "matchCriteriaId": "52048DDA-FC5A-4363-95A0-A6357B4D7F8C",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.9:rc4:*:*:*:*:*:*",
                    "matchCriteriaId": "A06B2CCF-3F43-4FA9-8773-C83C3F5764B2",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ninterconnect: Don\u0027t access req_list while it\u0027s being manipulated\n\nThe icc_lock mutex was split into separate icc_lock and icc_bw_lock\nmutexes in [1] to avoid lockdep splats. However, this didn\u0027t adequately\nprotect access to icc_node::req_list.\n\nThe icc_set_bw() function will eventually iterate over req_list while\nonly holding icc_bw_lock, but req_list can be modified while only\nholding icc_lock. This causes races between icc_set_bw(), of_icc_get(),\nand icc_put().\n\nExample A:\n\n  CPU0                               CPU1\n  ----                               ----\n  icc_set_bw(path_a)\n    mutex_lock(\u0026icc_bw_lock);\n                                     icc_put(path_b)\n                                       mutex_lock(\u0026icc_lock);\n    aggregate_requests()\n      hlist_for_each_entry(r, ...\n                                       hlist_del(...\n        \u003cr = invalid pointer\u003e\n\nExample B:\n\n  CPU0                               CPU1\n  ----                               ----\n  icc_set_bw(path_a)\n    mutex_lock(\u0026icc_bw_lock);\n                                     path_b = of_icc_get()\n                                       of_icc_get_by_index()\n                                         mutex_lock(\u0026icc_lock);\n                                         path_find()\n                                           path_init()\n    aggregate_requests()\n      hlist_for_each_entry(r, ...\n                                             hlist_add_head(...\n        \u003cr = invalid pointer\u003e\n\nFix this by ensuring icc_bw_lock is always held before manipulating\nicc_node::req_list. The additional places icc_bw_lock is held don\u0027t\nperform any memory allocations, so we should still be safe from the\noriginal lockdep splats that motivated the separate locks.\n\n[1] commit af42269c3523 (\"interconnect: Fix locking for runpm vs reclaim\")"
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: interconexi\u00f3n: no acceder a req_list mientras se est\u00e1 manipulando. El mutex icc_lock se dividi\u00f3 en mutex icc_lock e icc_bw_lock separados en [1] para evitar s\u00edmbolos de bloqueo. Sin embargo, esto no protegi\u00f3 adecuadamente el acceso a icc_node::req_list. La funci\u00f3n icc_set_bw() eventualmente iterar\u00e1 sobre req_list mientras solo mantiene icc_bw_lock, pero req_list se puede modificar mientras solo mantiene icc_lock. Esto provoca ejecuci\u00f3ns entre icc_set_bw(), of_icc_get() e icc_put(). Ejemplo A: CPU0 CPU1 ---- ---- icc_set_bw(path_a) mutex_lock(\u0026amp;icc_bw_lock); icc_put(ruta_b) mutex_lock(\u0026amp;icc_lock); agregado_requests() hlist_for_each_entry(r, ... hlist_del(...  Ejemplo B: CPU0 CPU1 ---- ---- icc_set_bw(path_a) mutex_lock(\u0026amp;icc_bw_lock); path_b = of_icc_get() of_icc_get_by_index( ) mutex_lock(\u0026amp;icc_lock); path_find() path_init() agregado_requests() hlist_for_each_entry(r, ... hlist_add_head(...  Solucione este problema asegur\u00e1ndose de que icc_bw_lock siempre se mantenga antes de manipular icc_node::req_list. El adicional Los lugares donde se mantiene icc_bw_lock no realizan ninguna asignaci\u00f3n de memoria, por lo que a\u00fan deber\u00edamos estar a salvo de los s\u00edmbolos de bloqueo originales que motivaron los bloqueos separados [1] commit af42269c3523 (\"interconexi\u00f3n: arreglar el bloqueo para runpm vs reclaim\")"
          }
        ],
        "id": "CVE-2024-27005",
        "lastModified": "2026-08-04T11:17:32.480",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "HIGH",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 6.3,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.0,
              "impactScore": 5.2,
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2024-27005",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-06T18:46:13.449387Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2024-05-01T06:15:18.883",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/19ec82b3cad1abef2a929262b8c1528f4e0c192d"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/4c65507121ea8e0b47fae6d2049c8688390d46b6"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/d0d04efa2e367921654b5106cc5c05e3757c2b42"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/de1bf25b6d771abdb52d43546cf57ad775fb68a1"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/fe549d8e976300d0dd75bd904eb216bed8b145e0"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/4c65507121ea8e0b47fae6d2049c8688390d46b6"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/d0d04efa2e367921654b5106cc5c05e3757c2b42"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/de1bf25b6d771abdb52d43546cf57ad775fb68a1"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4EZ6PJW7VOZ224TD7N4JZNU6KV32ZJ53/"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DAMSOZXJEPUOXW33WZYWCVAY7Z5S7OOY/"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GCBZZEC7L7KTWWAS2NLJK6SO3IZIL4WW/"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-362"
              },
              {
                "lang": "en",
                "value": "CWE-667"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-30T17:04:19+00:00",
      "cve": "CVE-2024-27005",
      "id": "CVE-2024-27005",
      "initial_release_date": "2024-05-01T00:00:00+00:00",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: interconnect: Don\u0027t access req_list while it\u0027s being manipulated",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-27005.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "providerMetadata": {
              "dateUpdated": "2025-11-04T17:16:33.949Z",
              "orgId": "af854a3a-2127-422b-91ae-364da2661108",
              "shortName": "CVE"
            },
            "references": [
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/d0d04efa2e367921654b5106cc5c05e3757c2b42"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/4c65507121ea8e0b47fae6d2049c8688390d46b6"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/de1bf25b6d771abdb52d43546cf57ad775fb68a1"
              },
              {
                "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DAMSOZXJEPUOXW33WZYWCVAY7Z5S7OOY/"
              },
              {
                "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4EZ6PJW7VOZ224TD7N4JZNU6KV32ZJ53/"
              },
              {
                "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GCBZZEC7L7KTWWAS2NLJK6SO3IZIL4WW/"
              }
            ],
            "title": "CVE Program Container"
          },
          {
            "metrics": [
              {
                "cvssV3_1": {
                  "attackComplexity": "HIGH",
                  "attackVector": "LOCAL",
                  "availabilityImpact": "HIGH",
                  "baseScore": 6.3,
                  "baseSeverity": "MEDIUM",
                  "confidentialityImpact": "HIGH",
                  "integrityImpact": "NONE",
                  "privilegesRequired": "LOW",
                  "scope": "UNCHANGED",
                  "userInteraction": "NONE",
                  "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:H",
                  "version": "3.1"
                }
              },
              {
                "other": {
                  "content": {
                    "id": "CVE-2024-27005",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2024-06-06T18:46:13.449387Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "problemTypes": [
              {
                "descriptions": [
                  {
                    "description": "CWE-noinfo Not enough information",
                    "lang": "en",
                    "type": "CWE"
                  }
                ]
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2024-06-06T18:46:17.724Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Linux",
              "programFiles": [
                "drivers/interconnect/core.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "lessThan": "fe549d8e976300d0dd75bd904eb216bed8b145e0",
                  "status": "affected",
                  "version": "9be2957f014d91088db1eb5dd09d9a03d7184dce",
                  "versionType": "git"
                },
                {
                  "lessThan": "19ec82b3cad1abef2a929262b8c1528f4e0c192d",
                  "status": "affected",
                  "version": "ee42bfc791aa3cd78e29046f26a09d189beb3efb",
                  "versionType": "git"
                },
                {
                  "lessThan": "d0d04efa2e367921654b5106cc5c05e3757c2b42",
                  "status": "affected",
                  "version": "af42269c3523492d71ebbe11fefae2653e9cdc78",
                  "versionType": "git"
                },
                {
                  "lessThan": "4c65507121ea8e0b47fae6d2049c8688390d46b6",
                  "status": "affected",
                  "version": "af42269c3523492d71ebbe11fefae2653e9cdc78",
                  "versionType": "git"
                },
                {
                  "lessThan": "de1bf25b6d771abdb52d43546cf57ad775fb68a1",
                  "status": "affected",
                  "version": "af42269c3523492d71ebbe11fefae2653e9cdc78",
                  "versionType": "git"
                },
                {
                  "status": "affected",
                  "version": "2f3a124696d43de3c837f87a9f767c56ee86cf2a",
                  "versionType": "git"
                },
                {
                  "lessThan": "5.15.151",
                  "status": "affected",
                  "version": "5.15.133",
                  "versionType": "semver"
                },
                {
                  "lessThan": "6.1.81",
                  "status": "affected",
                  "version": "6.1.55",
                  "versionType": "semver"
                },
                {
                  "lessThan": "6.6",
                  "status": "affected",
                  "version": "6.5.5",
                  "versionType": "semver"
                }
              ]
            },
            {
              "defaultStatus": "affected",
              "product": "Linux",
              "programFiles": [
                "drivers/interconnect/core.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "status": "affected",
                  "version": "6.6"
                },
                {
                  "lessThan": "6.6",
                  "status": "unaffected",
                  "version": "0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.15.*",
                  "status": "unaffected",
                  "version": "5.15.151",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.1.*",
                  "status": "unaffected",
                  "version": "6.1.81",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.6.*",
                  "status": "unaffected",
                  "version": "6.6.29",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.8.*",
                  "status": "unaffected",
                  "version": "6.8.8",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "*",
                  "status": "unaffected",
                  "version": "6.9",
                  "versionType": "original_commit_for_fix"
                }
              ]
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.15.151",
                      "versionStartIncluding": "5.15.133",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.1.81",
                      "versionStartIncluding": "6.1.55",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.6.29",
                      "versionStartIncluding": "6.6",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.8.8",
                      "versionStartIncluding": "6.6",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.9",
                      "versionStartIncluding": "6.6",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionStartIncluding": "6.5.5",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ninterconnect: Don\u0027t access req_list while it\u0027s being manipulated\n\nThe icc_lock mutex was split into separate icc_lock and icc_bw_lock\nmutexes in [1] to avoid lockdep splats. However, this didn\u0027t adequately\nprotect access to icc_node::req_list.\n\nThe icc_set_bw() function will eventually iterate over req_list while\nonly holding icc_bw_lock, but req_list can be modified while only\nholding icc_lock. This causes races between icc_set_bw(), of_icc_get(),\nand icc_put().\n\nExample A:\n\n  CPU0                               CPU1\n  ----                               ----\n  icc_set_bw(path_a)\n    mutex_lock(\u0026icc_bw_lock);\n                                     icc_put(path_b)\n                                       mutex_lock(\u0026icc_lock);\n    aggregate_requests()\n      hlist_for_each_entry(r, ...\n                                       hlist_del(...\n        \u003cr = invalid pointer\u003e\n\nExample B:\n\n  CPU0                               CPU1\n  ----                               ----\n  icc_set_bw(path_a)\n    mutex_lock(\u0026icc_bw_lock);\n                                     path_b = of_icc_get()\n                                       of_icc_get_by_index()\n                                         mutex_lock(\u0026icc_lock);\n                                         path_find()\n                                           path_init()\n    aggregate_requests()\n      hlist_for_each_entry(r, ...\n                                             hlist_add_head(...\n        \u003cr = invalid pointer\u003e\n\nFix this by ensuring icc_bw_lock is always held before manipulating\nicc_node::req_list. The additional places icc_bw_lock is held don\u0027t\nperform any memory allocations, so we should still be safe from the\noriginal lockdep splats that motivated the separate locks.\n\n[1] commit af42269c3523 (\"interconnect: Fix locking for runpm vs reclaim\")"
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "scenarios": [
                {
                  "lang": "en",
                  "value": "AV:L - The interconnect framework is reached only through local syscall paths \u2014 V4L2 ioctls on /dev/videoN (venus), DRM render-node submissions driving GPU devfreq, block I/O driving UFS/eMMC clock scaling \u2014 all of which require local access to the device. No network-facing protocol handler reaches `icc_set_bw()` or `icc_put()`.\nAC:L - The attacker directly controls the reading side of the race and can spin it in a tight loop (repeated `VIDIOC_STREAMON`/`STREAMOFF` on /dev/videoN, or continuous GPU/IO load forcing OPP bandwidth transitions), so the `req_list` walk in `aggregate_requests()` can be issued arbitrarily often against recurring `path_init()`/`icc_put()` mutations, with unlimited retries and no condition outside the attacker\u0027s influence gating success.\nPR:L - An ordinary unprivileged local account suffices \u2014 access to /dev/videoN (video/media group, or any app on Android), /dev/dri/renderD128, or simply generating filesystem I/O is enough to drive `icc_set_bw()` into `aggregate_requests()`. No capability, root, or namespace privilege is required.\nUI:N - The attacker\u0027s own process triggers both the bandwidth-vote storm and the racing condition entirely on its own. No victim action, no file to open, no filesystem to mount.\nS:U - The corruption is confined to kernel heap objects and interconnect provider state within the same kernel security authority. There is no VM, IOMMU, or sandbox boundary crossed.\nC:H - The list walk continues through a `kfree()`d `struct icc_path` from a general-purpose kmalloc cache, so a sprayed `req_node.next` steers subsequent iterations to arbitrary kernel addresses, reading `enabled`/`tag`/`avg_bw`/`peak_bw` from them; those values surface in `node-\u003eavg_bw`/`peak_bw`, giving a use-after-free based arbitrary-read primitive.\nI:H - This is a use-after-free plus hlist corruption on a `GFP_KERNEL` kmalloc object, which is a standard heap-spray and write-primitive foundation; concretely, garbage read from freed memory is aggregated into `node-\u003eavg_bw`/`peak_bw` and programmed into interconnect hardware through `apply_constraints()` \u2192 `p-\u003eset()`, corrupting system bus configuration.\nA:H - `icc_put()` uses `hlist_del()` (leaving `LIST_POISON1` in `next`) immediately followed by `kfree(path)`, so a racing `hlist_for_each_entry()` dereferences a poison or dangling pointer and oopses/panics the kernel; `hlist_add_head()` racing the same walk can likewise send it into a corrupted chain."
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-05T11:28:55.925Z",
            "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "shortName": "Linux"
          },
          "references": [
            {
              "url": "https://git.kernel.org/stable/c/fe549d8e976300d0dd75bd904eb216bed8b145e0"
            },
            {
              "url": "https://git.kernel.org/stable/c/19ec82b3cad1abef2a929262b8c1528f4e0c192d"
            },
            {
              "url": "https://git.kernel.org/stable/c/d0d04efa2e367921654b5106cc5c05e3757c2b42"
            },
            {
              "url": "https://git.kernel.org/stable/c/4c65507121ea8e0b47fae6d2049c8688390d46b6"
            },
            {
              "url": "https://git.kernel.org/stable/c/de1bf25b6d771abdb52d43546cf57ad775fb68a1"
            }
          ],
          "title": "interconnect: Don\u0027t access req_list while it\u0027s being manipulated",
          "x_generator": {
            "engine": "bippy-1.2.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "assignerShortName": "Linux",
        "cveId": "CVE-2024-27005",
        "datePublished": "2024-05-01T05:28:59.193Z",
        "dateReserved": "2024-02-19T14:20:24.207Z",
        "dateUpdated": "2026-08-05T11:28:55.925Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.