GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2024-36908 (GCVE-0-2024-36908)

Vulnerability from cvelistv5 – Published: 2024-05-30 15:29 – Updated: 2026-05-11 20:16
VLAI
Title
blk-iocost: do not WARN if iocg was already offlined
Summary
In the Linux kernel, the following vulnerability has been resolved: blk-iocost: do not WARN if iocg was already offlined In iocg_pay_debt(), warn is triggered if 'active_list' is empty, which is intended to confirm iocg is active when it has debt. However, warn can be triggered during a blkcg or disk removal, if iocg_waitq_timer_fn() is run at that time: WARNING: CPU: 0 PID: 2344971 at block/blk-iocost.c:1402 iocg_pay_debt+0x14c/0x190 Call trace: iocg_pay_debt+0x14c/0x190 iocg_kick_waitq+0x438/0x4c0 iocg_waitq_timer_fn+0xd8/0x130 __run_hrtimer+0x144/0x45c __hrtimer_run_queues+0x16c/0x244 hrtimer_interrupt+0x2cc/0x7b0 The warn in this situation is meaningless. Since this iocg is being removed, the state of the 'active_list' is irrelevant, and 'waitq_timer' is canceled after removing 'active_list' in ioc_pd_free(), which ensures iocg is freed after iocg_waitq_timer_fn() returns. Therefore, add the check if iocg was already offlined to avoid warn when removing a blkcg or disk.
Severity
7.1 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-05-31 18:30 UTC
CWE
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 7caa47151ab2e644dd221f741ec7578d9532c9a3 , < 56a9d07f427378eeb75b917bb49c6fbea8204126 (git)
Affected: 7caa47151ab2e644dd221f741ec7578d9532c9a3 , < 7d215e013d097ed6fc4b0ad0272c9514214dc408 (git)
Affected: 7caa47151ab2e644dd221f741ec7578d9532c9a3 , < aed0aac18f039dd4af13c143063754efca358cb0 (git)
Affected: 7caa47151ab2e644dd221f741ec7578d9532c9a3 , < 1c172ac7afe4442964f4153b2c78fe4e005d9d67 (git)
Affected: 7caa47151ab2e644dd221f741ec7578d9532c9a3 , < 14b3275f93d4a0d8ddc02195bc4e9869b7a3700e (git)
Affected: 7caa47151ab2e644dd221f741ec7578d9532c9a3 , < 01bc4fda9ea0a6b52f12326486f07a4910666cf6 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.4
Unaffected: 0 , < 5.4 (semver)
Unaffected: 5.10.237 , ≤ 5.10.* (semver)
Unaffected: 5.15.181 , ≤ 5.15.* (semver)
Unaffected: 6.1.135 , ≤ 6.1.* (semver)
Unaffected: 6.6.31 , ≤ 6.6.* (semver)
Unaffected: 6.8.10 , ≤ 6.8.* (semver)
Unaffected: 6.9 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.1,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-36908",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-31T18:30:12.396680Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "description": "CWE-noinfo Not enough information",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-07T16:16:27.980Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T19:30:10.572Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/1c172ac7afe4442964f4153b2c78fe4e005d9d67"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/14b3275f93d4a0d8ddc02195bc4e9869b7a3700e"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/01bc4fda9ea0a6b52f12326486f07a4910666cf6"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "block/blk-iocost.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "56a9d07f427378eeb75b917bb49c6fbea8204126",
              "status": "affected",
              "version": "7caa47151ab2e644dd221f741ec7578d9532c9a3",
              "versionType": "git"
            },
            {
              "lessThan": "7d215e013d097ed6fc4b0ad0272c9514214dc408",
              "status": "affected",
              "version": "7caa47151ab2e644dd221f741ec7578d9532c9a3",
              "versionType": "git"
            },
            {
              "lessThan": "aed0aac18f039dd4af13c143063754efca358cb0",
              "status": "affected",
              "version": "7caa47151ab2e644dd221f741ec7578d9532c9a3",
              "versionType": "git"
            },
            {
              "lessThan": "1c172ac7afe4442964f4153b2c78fe4e005d9d67",
              "status": "affected",
              "version": "7caa47151ab2e644dd221f741ec7578d9532c9a3",
              "versionType": "git"
            },
            {
              "lessThan": "14b3275f93d4a0d8ddc02195bc4e9869b7a3700e",
              "status": "affected",
              "version": "7caa47151ab2e644dd221f741ec7578d9532c9a3",
              "versionType": "git"
            },
            {
              "lessThan": "01bc4fda9ea0a6b52f12326486f07a4910666cf6",
              "status": "affected",
              "version": "7caa47151ab2e644dd221f741ec7578d9532c9a3",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "block/blk-iocost.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.4"
            },
            {
              "lessThan": "5.4",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.237",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.181",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.135",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.31",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.8.*",
              "status": "unaffected",
              "version": "6.8.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.9",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.237",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.181",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.135",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.31",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8.10",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nblk-iocost: do not WARN if iocg was already offlined\n\nIn iocg_pay_debt(), warn is triggered if \u0027active_list\u0027 is empty, which\nis intended to confirm iocg is active when it has debt. However, warn\ncan be triggered during a blkcg or disk removal, if iocg_waitq_timer_fn()\nis run at that time:\n\n  WARNING: CPU: 0 PID: 2344971 at block/blk-iocost.c:1402 iocg_pay_debt+0x14c/0x190\n  Call trace:\n  iocg_pay_debt+0x14c/0x190\n  iocg_kick_waitq+0x438/0x4c0\n  iocg_waitq_timer_fn+0xd8/0x130\n  __run_hrtimer+0x144/0x45c\n  __hrtimer_run_queues+0x16c/0x244\n  hrtimer_interrupt+0x2cc/0x7b0\n\nThe warn in this situation is meaningless. Since this iocg is being\nremoved, the state of the \u0027active_list\u0027 is irrelevant, and \u0027waitq_timer\u0027\nis canceled after removing \u0027active_list\u0027 in ioc_pd_free(), which ensures\niocg is freed after iocg_waitq_timer_fn() returns.\n\nTherefore, add the check if iocg was already offlined to avoid warn\nwhen removing a blkcg or disk."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T20:16:48.230Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/56a9d07f427378eeb75b917bb49c6fbea8204126"
        },
        {
          "url": "https://git.kernel.org/stable/c/7d215e013d097ed6fc4b0ad0272c9514214dc408"
        },
        {
          "url": "https://git.kernel.org/stable/c/aed0aac18f039dd4af13c143063754efca358cb0"
        },
        {
          "url": "https://git.kernel.org/stable/c/1c172ac7afe4442964f4153b2c78fe4e005d9d67"
        },
        {
          "url": "https://git.kernel.org/stable/c/14b3275f93d4a0d8ddc02195bc4e9869b7a3700e"
        },
        {
          "url": "https://git.kernel.org/stable/c/01bc4fda9ea0a6b52f12326486f07a4910666cf6"
        }
      ],
      "title": "blk-iocost: do not WARN if iocg was already offlined",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-36908",
    "datePublished": "2024-05-30T15:29:07.773Z",
    "dateReserved": "2024-05-30T15:25:07.067Z",
    "dateUpdated": "2026-05-11T20:16:48.230Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-36908",
      "date": "2026-09-16",
      "epss": "0.00249",
      "percentile": "0.1635"
    },
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nblk-iocost: do not WARN if iocg was already offlined\\n\\nIn iocg_pay_debt(), warn is triggered if \u0027active_list\u0027 is empty, which\\nis intended to confirm iocg is active when it has debt. However, warn\\ncan be triggered during a blkcg or disk removal, if iocg_waitq_timer_fn()\\nis run at that time:\\n\\n  WARNING: CPU: 0 PID: 2344971 at block/blk-iocost.c:1402 iocg_pay_debt+0x14c/0x190\\n  Call trace:\\n  iocg_pay_debt+0x14c/0x190\\n  iocg_kick_waitq+0x438/0x4c0\\n  iocg_waitq_timer_fn+0xd8/0x130\\n  __run_hrtimer+0x144/0x45c\\n  __hrtimer_run_queues+0x16c/0x244\\n  hrtimer_interrupt+0x2cc/0x7b0\\n\\nThe warn in this situation is meaningless. Since this iocg is being\\nremoved, the state of the \u0027active_list\u0027 is irrelevant, and \u0027waitq_timer\u0027\\nis canceled after removing \u0027active_list\u0027 in ioc_pd_free(), which ensures\\niocg is freed after iocg_waitq_timer_fn() returns.\\n\\nTherefore, add the check if iocg was already offlined to avoid warn\\nwhen removing a blkcg or disk.\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: blk-iocost: no ADVERTIR si iocg ya estaba desconectado. En iocg_pay_debt(), se activa una advertencia si \u0027active_list\u0027 est\\u00e1 vac\\u00eda, lo que pretende confirmar que iocg est\\u00e1 activo cuando deuda. Sin embargo, se puede activar una advertencia durante un blkcg o la eliminaci\\u00f3n de un disco, si se ejecuta iocg_waitq_timer_fn() en ese momento: ADVERTENCIA: CPU: 0 PID: 2344971 en block/blk-iocost.c:1402 iocg_pay_debt+0x14c/0x190 Seguimiento de llamadas: iocg_pay_debt +0x14c/0x190 iocg_kick_waitq+0x438/0x4c0 iocg_waitq_timer_fn+0xd8/0x130 __run_hrtimer+0x144/0x45c __hrtimer_run_queues+0x16c/0x244 hrtimer_interrupt+0x2cc/0x7b0 La advertencia en esta situaci\\u00f3n es sin sentido. Dado que este iocg se est\\u00e1 eliminando, el estado de \u0027active_list\u0027 es irrelevante y \u0027waitq_timer\u0027 se cancela despu\\u00e9s de eliminar \u0027active_list\u0027 en ioc_pd_free(), lo que garantiza que iocg se libere despu\\u00e9s de que iocg_waitq_timer_fn() regrese. Por lo tanto, agregue la verificaci\\u00f3n si iocg ya estaba desconectado para evitar advertencias al eliminar un blkcg o un disco.\"}]",
      "id": "CVE-2024-36908",
      "lastModified": "2024-11-21T09:22:47.393",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H\", \"baseScore\": 7.1, \"baseSeverity\": \"HIGH\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 5.2}]}",
      "published": "2024-05-30T16:15:14.300",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/01bc4fda9ea0a6b52f12326486f07a4910666cf6\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/14b3275f93d4a0d8ddc02195bc4e9869b7a3700e\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/1c172ac7afe4442964f4153b2c78fe4e005d9d67\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/01bc4fda9ea0a6b52f12326486f07a4910666cf6\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/14b3275f93d4a0d8ddc02195bc4e9869b7a3700e\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/1c172ac7afe4442964f4153b2c78fe4e005d9d67\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Awaiting Analysis"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-36908\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-05-30T16:15:14.300\",\"lastModified\":\"2026-06-17T07:37:20.027\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nblk-iocost: do not WARN if iocg was already offlined\\n\\nIn iocg_pay_debt(), warn is triggered if \u0027active_list\u0027 is empty, which\\nis intended to confirm iocg is active when it has debt. However, warn\\ncan be triggered during a blkcg or disk removal, if iocg_waitq_timer_fn()\\nis run at that time:\\n\\n  WARNING: CPU: 0 PID: 2344971 at block/blk-iocost.c:1402 iocg_pay_debt+0x14c/0x190\\n  Call trace:\\n  iocg_pay_debt+0x14c/0x190\\n  iocg_kick_waitq+0x438/0x4c0\\n  iocg_waitq_timer_fn+0xd8/0x130\\n  __run_hrtimer+0x144/0x45c\\n  __hrtimer_run_queues+0x16c/0x244\\n  hrtimer_interrupt+0x2cc/0x7b0\\n\\nThe warn in this situation is meaningless. Since this iocg is being\\nremoved, the state of the \u0027active_list\u0027 is irrelevant, and \u0027waitq_timer\u0027\\nis canceled after removing \u0027active_list\u0027 in ioc_pd_free(), which ensures\\niocg is freed after iocg_waitq_timer_fn() returns.\\n\\nTherefore, add the check if iocg was already offlined to avoid warn\\nwhen removing a blkcg or disk.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: blk-iocost: no ADVERTIR si iocg ya estaba desconectado. En iocg_pay_debt(), se activa una advertencia si \u0027active_list\u0027 est\u00e1 vac\u00eda, lo que pretende confirmar que iocg est\u00e1 activo cuando deuda. Sin embargo, se puede activar una advertencia durante un blkcg o la eliminaci\u00f3n de un disco, si se ejecuta iocg_waitq_timer_fn() en ese momento: ADVERTENCIA: CPU: 0 PID: 2344971 en block/blk-iocost.c:1402 iocg_pay_debt+0x14c/0x190 Seguimiento de llamadas: iocg_pay_debt +0x14c/0x190 iocg_kick_waitq+0x438/0x4c0 iocg_waitq_timer_fn+0xd8/0x130 __run_hrtimer+0x144/0x45c __hrtimer_run_queues+0x16c/0x244 hrtimer_interrupt+0x2cc/0x7b0 La advertencia en esta situaci\u00f3n es sin sentido. Dado que este iocg se est\u00e1 eliminando, el estado de \u0027active_list\u0027 es irrelevante y \u0027waitq_timer\u0027 se cancela despu\u00e9s de eliminar \u0027active_list\u0027 en ioc_pd_free(), lo que garantiza que iocg se libere despu\u00e9s de que iocg_waitq_timer_fn() regrese. Por lo tanto, agregue la verificaci\u00f3n si iocg ya estaba desconectado para evitar advertencias al eliminar un blkcg o un disco.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"block/blk-iocost.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"7caa47151ab2e644dd221f741ec7578d9532c9a3\",\"lessThan\":\"56a9d07f427378eeb75b917bb49c6fbea8204126\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"7caa47151ab2e644dd221f741ec7578d9532c9a3\",\"lessThan\":\"7d215e013d097ed6fc4b0ad0272c9514214dc408\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"7caa47151ab2e644dd221f741ec7578d9532c9a3\",\"lessThan\":\"aed0aac18f039dd4af13c143063754efca358cb0\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"7caa47151ab2e644dd221f741ec7578d9532c9a3\",\"lessThan\":\"1c172ac7afe4442964f4153b2c78fe4e005d9d67\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"7caa47151ab2e644dd221f741ec7578d9532c9a3\",\"lessThan\":\"14b3275f93d4a0d8ddc02195bc4e9869b7a3700e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"7caa47151ab2e644dd221f741ec7578d9532c9a3\",\"lessThan\":\"01bc4fda9ea0a6b52f12326486f07a4910666cf6\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"block/blk-iocost.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.4\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.4\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.237\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.181\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.135\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.31\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.8.10\",\"lessThanOrEqual\":\"6.8.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.9\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H\",\"baseScore\":7.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.2}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-05-31T18:30:12.396680Z\",\"id\":\"CVE-2024-36908\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.4\",\"versionEndExcluding\":\"5.10.237\",\"matchCriteriaId\":\"6826B8B5-54FB-48E9-972A-4C0A4579A466\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.181\",\"matchCriteriaId\":\"12331C9E-F601-4EFC-899E-369F98DCC70B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.135\",\"matchCriteriaId\":\"5B9ACE29-7445-4B6F-B761-6367C005E275\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.31\",\"matchCriteriaId\":\"CDDB1F69-36AC-41C1-9192-E7CCEF5FFC00\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.8.10\",\"matchCriteriaId\":\"6A6B920C-8D8F-4130-86B4-AD334F4CF2E3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.9:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"22BEDD49-2C6D-402D-9DBF-6646F6ECD10B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.9:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"DF73CB2A-DFFD-46FB-9BFE-AA394F27EA37\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.9:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"52048DDA-FC5A-4363-95A0-A6357B4D7F8C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.9:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"A06B2CCF-3F43-4FA9-8773-C83C3F5764B2\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/01bc4fda9ea0a6b52f12326486f07a4910666cf6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/14b3275f93d4a0d8ddc02195bc4e9869b7a3700e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/1c172ac7afe4442964f4153b2c78fe4e005d9d67\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/56a9d07f427378eeb75b917bb49c6fbea8204126\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/7d215e013d097ed6fc4b0ad0272c9514214dc408\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/aed0aac18f039dd4af13c143063754efca358cb0\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/01bc4fda9ea0a6b52f12326486f07a4910666cf6\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/14b3275f93d4a0d8ddc02195bc4e9869b7a3700e\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/1c172ac7afe4442964f4153b2c78fe4e005d9d67\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2025-11-21T10:47:31+00:00",
      "cve": "CVE-2024-36908",
      "id": "CVE-2024-36908",
      "initial_release_date": "2024-05-30T00:00:00+00:00",
      "product_status:known_affected": "28",
      "product_status:known_not_affected": "170",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: blk-iocost: do not WARN if iocg was already offlined",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-36908.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-15T02:23:42Z",
      "cve": "CVE-2024-36908",
      "id": "CVE-2024-36908",
      "initial_release_date": "2024-06-01T02:23:25Z",
      "product_status:known_affected": "645",
      "product_status:known_not_affected": "180",
      "product_status:recommended": "280",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-36908",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-36908.json",
      "version": "123"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/1c172ac7afe4442964f4153b2c78fe4e005d9d67\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/14b3275f93d4a0d8ddc02195bc4e9869b7a3700e\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/01bc4fda9ea0a6b52f12326486f07a4910666cf6\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T03:43:49.881Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.1, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-36908\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-05-31T18:30:12.396680Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"description\": \"CWE-noinfo Not enough information\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-05-31T18:30:17.057Z\"}}], \"cna\": {\"title\": \"blk-iocost: do not WARN if iocg was already offlined\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"7caa47151ab2e644dd221f741ec7578d9532c9a3\", \"lessThan\": \"aed0aac18f039dd4af13c143063754efca358cb0\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"7caa47151ab2e644dd221f741ec7578d9532c9a3\", \"lessThan\": \"1c172ac7afe4442964f4153b2c78fe4e005d9d67\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"7caa47151ab2e644dd221f741ec7578d9532c9a3\", \"lessThan\": \"14b3275f93d4a0d8ddc02195bc4e9869b7a3700e\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"7caa47151ab2e644dd221f741ec7578d9532c9a3\", \"lessThan\": \"01bc4fda9ea0a6b52f12326486f07a4910666cf6\", \"versionType\": \"git\"}], \"programFiles\": [\"block/blk-iocost.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.4\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.4\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.1.135\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.31\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.8.10\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.8.*\"}, {\"status\": \"unaffected\", \"version\": \"6.9\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"block/blk-iocost.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/aed0aac18f039dd4af13c143063754efca358cb0\"}, {\"url\": \"https://git.kernel.org/stable/c/1c172ac7afe4442964f4153b2c78fe4e005d9d67\"}, {\"url\": \"https://git.kernel.org/stable/c/14b3275f93d4a0d8ddc02195bc4e9869b7a3700e\"}, {\"url\": \"https://git.kernel.org/stable/c/01bc4fda9ea0a6b52f12326486f07a4910666cf6\"}], \"x_generator\": {\"engine\": \"bippy-1.1.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nblk-iocost: do not WARN if iocg was already offlined\\n\\nIn iocg_pay_debt(), warn is triggered if \u0027active_list\u0027 is empty, which\\nis intended to confirm iocg is active when it has debt. However, warn\\ncan be triggered during a blkcg or disk removal, if iocg_waitq_timer_fn()\\nis run at that time:\\n\\n  WARNING: CPU: 0 PID: 2344971 at block/blk-iocost.c:1402 iocg_pay_debt+0x14c/0x190\\n  Call trace:\\n  iocg_pay_debt+0x14c/0x190\\n  iocg_kick_waitq+0x438/0x4c0\\n  iocg_waitq_timer_fn+0xd8/0x130\\n  __run_hrtimer+0x144/0x45c\\n  __hrtimer_run_queues+0x16c/0x244\\n  hrtimer_interrupt+0x2cc/0x7b0\\n\\nThe warn in this situation is meaningless. Since this iocg is being\\nremoved, the state of the \u0027active_list\u0027 is irrelevant, and \u0027waitq_timer\u0027\\nis canceled after removing \u0027active_list\u0027 in ioc_pd_free(), which ensures\\niocg is freed after iocg_waitq_timer_fn() returns.\\n\\nTherefore, add the check if iocg was already offlined to avoid warn\\nwhen removing a blkcg or disk.\"}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2025-04-25T10:06:36.111Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-36908\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-04-25T10:06:36.111Z\", \"dateReserved\": \"2024-05-30T15:25:07.067Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-05-30T15:29:07.773Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.