Skip to content
Fencer Vulns
medium 5.5

CVE-2024-43855 json

md: fix deadlock between mddev_suspend and flush bio

published 2024-08-17 2 y ago modified 2026-06-17 4 mo ago also EUVD-2024-40505

cvss
5.5
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
0.2%
EPSS 0.2% chance of exploitation in 30 days, percentile 11%
public exploits
0
none known

Summary

In the Linux kernel, the following vulnerability has been resolved:

md: fix deadlock between mddev_suspend and flush bio

Deadlock occurs when mddev is being suspended while some flush bio is in progress. It is a complex issue.

T1. the first flush is at the ending stage, it clears 'mddev->flush_bio' and tries to submit data, but is blocked because mddev is suspended by T4. T2. the second flush sets 'mddev->flush_bio', and attempts to queue md_submit_flush_data(), which is already running (T1) and won't execute again if on the same CPU as T1. T3. the third flush inc active_io and tries to flush, but is blocked because 'mddev->flush_bio' is not NULL (set by T2). T4. mddev_suspend() is called and waits for active_io dec to 0 which is inc by T3.

T1 T2 T3 T4 (flush 1) (flush 2) (third 3) (suspend) md_submit_flush_data mddev->flush_bio = NULL; . . md_flush_request . mddev->flush_bio = bio . queue submit_flushes . . . . md_handle_request . . active_io + 1 . . md_flush_request . . wait !mddev->flush_bio . . . . mddev_suspend . . wait !active_io . . . submit_flushes . queue_work md_submit_flush_data . //md_submit_flush_data is already running (T1) . md_handle_request wait resume

The root issue is non-atomic inc/dec of active_io during flush process. active_io is dec before md_submit_flush_data is queued, and inc soon after md_submit_flush_data() run. md_flush_request active_io + 1 submit_flushes active_io - 1 md_submit_flush_data md_handle_request active_io + 1 make_request active_io - 1

If active_io is dec after md_handle_request() instead of within submit_flushes(), make_request() can be called directly intead of md_handle_request() in md_submit_flush_data(), and active_io will only inc and dec once in the whole flush process. Deadlock will be fixed.

Additionally, the only difference between fixing the issue and before is that there is no return error handling of make_request(). But after previous patch cleaned md_write_start(), make_requst() only return error in raid5_make_request() by dm-raid, see commit 41425f96d7aa ("dm-raid456, md/raid456: fix a deadlock for dm-raid456 while io concurrent with reshape)". Since dm always splits data and flush operation into two separate io, io size of flush submitted by dm always is 0, make_request() will not be called in md_submit_flush_data(). To prevent future modifications from introducing issues, add WARN_ON to ensure make_request() no error is returned in this context.

Patch / fix

  • Linux Linux 6.1.103, 6.6.44, 6.8, 6.10.3, 6.11
  • linux Debian 12 6.1.106-1
  • linux Debian 14, Debian 13 6.10.3-1

debian advisories DEBIAN-CVE-2024-43855

  • linux Ubuntu 24.04 LTS 6.8.0-48.48
  • linux-aws Ubuntu 24.04 LTS 6.8.0-1018.20
  • linux-gcp Ubuntu 24.04 LTS 6.8.0-1017.19
  • linux-gke Ubuntu 24.04 LTS 6.8.0-1013.17
  • linux-ibm Ubuntu 24.04 LTS 6.8.0-1015.15
  • linux-azure Ubuntu 24.04 LTS 6.8.0-1017.20
  • linux-gkeop Ubuntu 24.04 LTS 6.8.0-1002.4
  • linux-raspi Ubuntu 24.04 LTS 6.8.0-1014.16

ubuntu advisories UBUNTU-CVE-2024-43855

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • kernel RHEL 9 5.14.0-503.35.1.el9_5
  • rv RHEL 9 5.14.0-503.35.1.el9_5
  • perf RHEL 9 5.14.0-503.35.1.el9_5
  • rtla RHEL 9 5.14.0-503.35.1.el9_5
  • bpftool RHEL 9 7.4.0-503.35.1.el9_5
  • libperf RHEL 9 5.14.0-503.35.1.el9_5
  • kernel-rt RHEL 9 5.14.0-503.35.1.el9_5
  • kernel-64k RHEL 9 5.14.0-503.35.1.el9_5

red hat advisories RHSA-2025:3506

  • kernel-rt Linux Micro 6.0 6.4.0-10.1
  • kernel-source-rt Linux Micro 6.0 6.4.0-10.1
  • kernel-livepatch-MICRO-6-0-RT_Update_2 Linux Micro 6.0 1-1.1
  • kernel-source Linux Micro 6.0 6.4.0-19.1
  • kernel-default Linux Micro 6.0 6.4.0-19.1
  • kernel-kvmsmall Linux Micro 6.0 6.4.0-19.1
  • kernel-default-base Linux Micro 6.0 6.4.0-17.1.1.51
  • kernel-livepatch-MICRO-6-0_Update_2 Linux Micro 6.0 1-1.1

suse advisories SUSE-SU-2025:20047-1SUSE-SU-2025:20044-1SUSE-SU-2024:3383-1SUSE-SU-2024:3195-1SUSE-SU-2024:3194-1

  • kernel CBL-Mariner 2.0 5.15.167.1-1
  • kernel Azure Linux 3.0 6.6.47.1-1

azure linux advisories AZL-47968AZL-48003

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2024-43855 updated cvss 4.4

kernel: md: fix deadlock between mddev_suspend and flush bio

  • Red Hat Enterprise Linux 6 perf, kernel, python-perf, kernel-kdump, kernel-firmware, kernel-bootwrapper, +1 more Red Hat Enterprise Linux 7 perf, kernel, bpftool, kernel-rt, python-perf, kernel-kdump, +8 more
    affected: workaround, no fix planned “Out of support scope”
  • Red Hat CodeReady Linux Builder (v. 9) libperf 5.14.0-503.35.1.el9_5, kernel-debuginfo-common-s390x 5.14.0-503.35.1.el9_5, kernel-debuginfo-common-x86_64 5.14.0-503.35.1.el9_5, kernel-debuginfo-common-aarch64 5.14.0-503.35.1.el9_5, kernel-debuginfo-common-ppc64le 5.14.0-503.35.1.el9_5 Red Hat Enterprise Linux AppStream (v. 9) rv 5.14.0-503.35.1.el9_5, perf 5.14.0-503.35.1.el9_5, rtla 5.14.0-503.35.1.el9_5, kernel-devel-matched 5.14.0-503.35.1.el9_5, kernel-64k-devel-matched 5.14.0-503.35.1.el9_5, kernel-debug-devel-matched 5.14.0-503.35.1.el9_5, +6 more Red Hat Enterprise Linux BaseOS (v. 9) bpftool 7.4.0-503.35.1.el9_5, kernel 5.14.0-503.35.1.el9_5, kernel-64k 5.14.0-503.35.1.el9_5, kernel-core 5.14.0-503.35.1.el9_5, kernel-tools 5.14.0-503.35.1.el9_5, python3-perf 5.14.0-503.35.1.el9_5, +29 more Red Hat Enterprise Linux Real Time (v. 9) kernel-rt 5.14.0-503.35.1.el9_5, kernel-rt-core 5.14.0-503.35.1.el9_5, kernel-rt-modules 5.14.0-503.35.1.el9_5, kernel-rt-debug-core 5.14.0-503.35.1.el9_5, kernel-rt-modules-core 5.14.0-503.35.1.el9_5, kernel-rt-debug-modules 5.14.0-503.35.1.el9_5, +4 more Red Hat Enterprise Linux Real Time for NFV (v. 9) kernel-rt 5.14.0-503.35.1.el9_5, kernel-rt-kvm 5.14.0-503.35.1.el9_5, kernel-rt-core 5.14.0-503.35.1.el9_5, kernel-rt-modules 5.14.0-503.35.1.el9_5, kernel-rt-debug-kvm 5.14.0-503.35.1.el9_5, kernel-rt-debug-core 5.14.0-503.35.1.el9_5, +6 more
    fixed: vendor fix RHSA-2025:3506
  • Red Hat Enterprise Linux 8 perf, kernel, bpftool, kernel-rt, kernel-core, kernel-tools, +29 more Red Hat Enterprise Linux 9 kernel-rt, kernel-rt-kvm, kernel-rt-core, kernel-rt-modules, kernel-rt-debug-kvm, kernel-rt-debug-core, +12 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
2 y ago

Exploit prediction

0.21% chance of exploitation in the next 30 days, higher than 11% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.1 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

  • Linux Linux

Classification

Weakness
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.