CVE-2024-53100 (GCVE-0-2024-53100)
Vulnerability from cvelistv5 – Published: 2024-11-25 21:21 – Updated: 2026-08-05 11:43
VLAI
EPSS
VEX
Title
nvme: tcp: avoid race between queue_lock lock and destroy
Summary
In the Linux kernel, the following vulnerability has been resolved:
nvme: tcp: avoid race between queue_lock lock and destroy
Commit 76d54bf20cdc ("nvme-tcp: don't access released socket during
error recovery") added a mutex_lock() call for the queue->queue_lock
in nvme_tcp_get_address(). However, the mutex_lock() races with
mutex_destroy() in nvme_tcp_free_queue(), and causes the WARN below.
DEBUG_LOCKS_WARN_ON(lock->magic != lock)
WARNING: CPU: 3 PID: 34077 at kernel/locking/mutex.c:587 __mutex_lock+0xcf0/0x1220
Modules linked in: nvmet_tcp nvmet nvme_tcp nvme_fabrics iw_cm ib_cm ib_core pktcdvd nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 ip_set nf_tables qrtr sunrpc ppdev 9pnet_virtio 9pnet pcspkr netfs parport_pc parport e1000 i2c_piix4 i2c_smbus loop fuse nfnetlink zram bochs drm_vram_helper drm_ttm_helper ttm drm_kms_helper xfs drm sym53c8xx floppy nvme scsi_transport_spi nvme_core nvme_auth serio_raw ata_generic pata_acpi dm_multipath qemu_fw_cfg [last unloaded: ib_uverbs]
CPU: 3 UID: 0 PID: 34077 Comm: udisksd Not tainted 6.11.0-rc7 #319
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-2.fc40 04/01/2014
RIP: 0010:__mutex_lock+0xcf0/0x1220
Code: 08 84 d2 0f 85 c8 04 00 00 8b 15 ef b6 c8 01 85 d2 0f 85 78 f4 ff ff 48 c7 c6 20 93 ee af 48 c7 c7 60 91 ee af e8 f0 a7 6d fd <0f> 0b e9 5e f4 ff ff 48 b8 00 00 00 00 00 fc ff df 4c 89 f2 48 c1
RSP: 0018:ffff88811305f760 EFLAGS: 00010286
RAX: 0000000000000000 RBX: ffff88812c652058 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000004 RDI: 0000000000000001
RBP: ffff88811305f8b0 R08: 0000000000000001 R09: ffffed1075c36341
R10: ffff8883ae1b1a0b R11: 0000000000010498 R12: 0000000000000000
R13: 0000000000000000 R14: dffffc0000000000 R15: ffff88812c652058
FS: 00007f9713ae4980(0000) GS:ffff8883ae180000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fcd78483c7c CR3: 0000000122c38000 CR4: 00000000000006f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
? __warn.cold+0x5b/0x1af
? __mutex_lock+0xcf0/0x1220
? report_bug+0x1ec/0x390
? handle_bug+0x3c/0x80
? exc_invalid_op+0x13/0x40
? asm_exc_invalid_op+0x16/0x20
? __mutex_lock+0xcf0/0x1220
? nvme_tcp_get_address+0xc2/0x1e0 [nvme_tcp]
? __pfx___mutex_lock+0x10/0x10
? __lock_acquire+0xd6a/0x59e0
? nvme_tcp_get_address+0xc2/0x1e0 [nvme_tcp]
nvme_tcp_get_address+0xc2/0x1e0 [nvme_tcp]
? __pfx_nvme_tcp_get_address+0x10/0x10 [nvme_tcp]
nvme_sysfs_show_address+0x81/0xc0 [nvme_core]
dev_attr_show+0x42/0x80
? __asan_memset+0x1f/0x40
sysfs_kf_seq_show+0x1f0/0x370
seq_read_iter+0x2cb/0x1130
? rw_verify_area+0x3b1/0x590
? __mutex_lock+0x433/0x1220
vfs_read+0x6a6/0xa20
? lockdep_hardirqs_on+0x78/0x100
? __pfx_vfs_read+0x10/0x10
ksys_read+0xf7/0x1d0
? __pfx_ksys_read+0x10/0x10
? __x64_sys_openat+0x105/0x1d0
do_syscall_64+0x93/0x180
? lockdep_hardirqs_on_prepare+0x16d/0x400
? do_syscall_64+0x9f/0x180
? lockdep_hardirqs_on+0x78/0x100
? do_syscall_64+0x9f/0x180
? __pfx_ksys_read+0x10/0x10
? lockdep_hardirqs_on_prepare+0x16d/0x400
? do_syscall_64+0x9f/0x180
? lockdep_hardirqs_on+0x78/0x100
? do_syscall_64+0x9f/0x180
? lockdep_hardirqs_on_prepare+0x16d/0x400
? do_syscall_64+0x9f/0x180
? lockdep_hardirqs_on+0x78/0x100
? do_syscall_64+0x9f/0x180
? lockdep_hardirqs_on_prepare+0x16d/0x400
? do_syscall_64+0x9f/0x180
? lockdep_hardirqs_on+0x78/0x100
? do_syscall_64+0x9f/0x180
? lockdep_hardirqs_on_prepare+0x16d/0x400
? do_syscall_64+0x9f/0x180
? lockdep_hardirqs_on+0x78/0x100
? do_syscall_64+0x9f/0x180
? do_syscall_64+0x9f/0x180
entry_SYSCALL_64_after_hwframe+0x76/0x7e
RIP: 0033:0x7f9713f55cfa
Code: 55 48 89 e5 48 83 ec 20 48 89 55 e8 48 89 75 f0 89 7d f8 e8 e8 74 f8 ff 48 8b 55 e8 48 8b 75 f0 4
---truncated---
Severity
7.8 (High)
4.7 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-10-01 20:11 UTC
CWE
- CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| Linux | Linux |
Affected:
3f2304f8c6d6ed97849057bd16fee99e434ca796 , < 4f946479b326a3cbb193f2b8368aed9269514c35
(git)
Affected: 3f2304f8c6d6ed97849057bd16fee99e434ca796 , < 975cb1d2121511584695d0e47fdb90e6782da007 (git) Affected: 3f2304f8c6d6ed97849057bd16fee99e434ca796 , < e15cebc1b21856944b387f4abd03b66bd3d4f027 (git) Affected: 3f2304f8c6d6ed97849057bd16fee99e434ca796 , < 782373ba27660ba7d330208cf5509ece6feb4545 (git) |
guessed | |
| Linux | Linux |
Affected:
5.0
Unaffected: 0 , < 5.0 (semver) Unaffected: 6.1.118 , ≤ 6.1.* (semver) Unaffected: 6.6.62 , ≤ 6.6.* (semver) Unaffected: 6.11.9 , ≤ 6.11.* (semver) Unaffected: 6.12 , ≤ * (original_commit_for_fix) |
guessed |
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2024-53100",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-10-01T20:11:08.146191Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-362",
"description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-10-01T20:17:12.464Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2025-11-03T22:29:12.616Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/nvme/host/tcp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "4f946479b326a3cbb193f2b8368aed9269514c35",
"status": "affected",
"version": "3f2304f8c6d6ed97849057bd16fee99e434ca796",
"versionType": "git"
},
{
"lessThan": "975cb1d2121511584695d0e47fdb90e6782da007",
"status": "affected",
"version": "3f2304f8c6d6ed97849057bd16fee99e434ca796",
"versionType": "git"
},
{
"lessThan": "e15cebc1b21856944b387f4abd03b66bd3d4f027",
"status": "affected",
"version": "3f2304f8c6d6ed97849057bd16fee99e434ca796",
"versionType": "git"
},
{
"lessThan": "782373ba27660ba7d330208cf5509ece6feb4545",
"status": "affected",
"version": "3f2304f8c6d6ed97849057bd16fee99e434ca796",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/nvme/host/tcp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.0"
},
{
"lessThan": "5.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.118",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.62",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.11.*",
"status": "unaffected",
"version": "6.11.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.12",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.118",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.62",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.11.9",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12",
"versionStartIncluding": "5.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvme: tcp: avoid race between queue_lock lock and destroy\n\nCommit 76d54bf20cdc (\"nvme-tcp: don\u0027t access released socket during\nerror recovery\") added a mutex_lock() call for the queue-\u003equeue_lock\nin nvme_tcp_get_address(). However, the mutex_lock() races with\nmutex_destroy() in nvme_tcp_free_queue(), and causes the WARN below.\n\nDEBUG_LOCKS_WARN_ON(lock-\u003emagic != lock)\nWARNING: CPU: 3 PID: 34077 at kernel/locking/mutex.c:587 __mutex_lock+0xcf0/0x1220\nModules linked in: nvmet_tcp nvmet nvme_tcp nvme_fabrics iw_cm ib_cm ib_core pktcdvd nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 ip_set nf_tables qrtr sunrpc ppdev 9pnet_virtio 9pnet pcspkr netfs parport_pc parport e1000 i2c_piix4 i2c_smbus loop fuse nfnetlink zram bochs drm_vram_helper drm_ttm_helper ttm drm_kms_helper xfs drm sym53c8xx floppy nvme scsi_transport_spi nvme_core nvme_auth serio_raw ata_generic pata_acpi dm_multipath qemu_fw_cfg [last unloaded: ib_uverbs]\nCPU: 3 UID: 0 PID: 34077 Comm: udisksd Not tainted 6.11.0-rc7 #319\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-2.fc40 04/01/2014\nRIP: 0010:__mutex_lock+0xcf0/0x1220\nCode: 08 84 d2 0f 85 c8 04 00 00 8b 15 ef b6 c8 01 85 d2 0f 85 78 f4 ff ff 48 c7 c6 20 93 ee af 48 c7 c7 60 91 ee af e8 f0 a7 6d fd \u003c0f\u003e 0b e9 5e f4 ff ff 48 b8 00 00 00 00 00 fc ff df 4c 89 f2 48 c1\nRSP: 0018:ffff88811305f760 EFLAGS: 00010286\nRAX: 0000000000000000 RBX: ffff88812c652058 RCX: 0000000000000000\nRDX: 0000000000000000 RSI: 0000000000000004 RDI: 0000000000000001\nRBP: ffff88811305f8b0 R08: 0000000000000001 R09: ffffed1075c36341\nR10: ffff8883ae1b1a0b R11: 0000000000010498 R12: 0000000000000000\nR13: 0000000000000000 R14: dffffc0000000000 R15: ffff88812c652058\nFS: 00007f9713ae4980(0000) GS:ffff8883ae180000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007fcd78483c7c CR3: 0000000122c38000 CR4: 00000000000006f0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n \u003cTASK\u003e\n ? __warn.cold+0x5b/0x1af\n ? __mutex_lock+0xcf0/0x1220\n ? report_bug+0x1ec/0x390\n ? handle_bug+0x3c/0x80\n ? exc_invalid_op+0x13/0x40\n ? asm_exc_invalid_op+0x16/0x20\n ? __mutex_lock+0xcf0/0x1220\n ? nvme_tcp_get_address+0xc2/0x1e0 [nvme_tcp]\n ? __pfx___mutex_lock+0x10/0x10\n ? __lock_acquire+0xd6a/0x59e0\n ? nvme_tcp_get_address+0xc2/0x1e0 [nvme_tcp]\n nvme_tcp_get_address+0xc2/0x1e0 [nvme_tcp]\n ? __pfx_nvme_tcp_get_address+0x10/0x10 [nvme_tcp]\n nvme_sysfs_show_address+0x81/0xc0 [nvme_core]\n dev_attr_show+0x42/0x80\n ? __asan_memset+0x1f/0x40\n sysfs_kf_seq_show+0x1f0/0x370\n seq_read_iter+0x2cb/0x1130\n ? rw_verify_area+0x3b1/0x590\n ? __mutex_lock+0x433/0x1220\n vfs_read+0x6a6/0xa20\n ? lockdep_hardirqs_on+0x78/0x100\n ? __pfx_vfs_read+0x10/0x10\n ksys_read+0xf7/0x1d0\n ? __pfx_ksys_read+0x10/0x10\n ? __x64_sys_openat+0x105/0x1d0\n do_syscall_64+0x93/0x180\n ? lockdep_hardirqs_on_prepare+0x16d/0x400\n ? do_syscall_64+0x9f/0x180\n ? lockdep_hardirqs_on+0x78/0x100\n ? do_syscall_64+0x9f/0x180\n ? __pfx_ksys_read+0x10/0x10\n ? lockdep_hardirqs_on_prepare+0x16d/0x400\n ? do_syscall_64+0x9f/0x180\n ? lockdep_hardirqs_on+0x78/0x100\n ? do_syscall_64+0x9f/0x180\n ? lockdep_hardirqs_on_prepare+0x16d/0x400\n ? do_syscall_64+0x9f/0x180\n ? lockdep_hardirqs_on+0x78/0x100\n ? do_syscall_64+0x9f/0x180\n ? lockdep_hardirqs_on_prepare+0x16d/0x400\n ? do_syscall_64+0x9f/0x180\n ? lockdep_hardirqs_on+0x78/0x100\n ? do_syscall_64+0x9f/0x180\n ? lockdep_hardirqs_on_prepare+0x16d/0x400\n ? do_syscall_64+0x9f/0x180\n ? lockdep_hardirqs_on+0x78/0x100\n ? do_syscall_64+0x9f/0x180\n ? do_syscall_64+0x9f/0x180\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\nRIP: 0033:0x7f9713f55cfa\nCode: 55 48 89 e5 48 83 ec 20 48 89 55 e8 48 89 75 f0 89 7d f8 e8 e8 74 f8 ff 48 8b 55 e8 48 8b 75 f0 4\n---truncated---"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable function `nvme_tcp_get_address()` is only entered through a local `read()` syscall on the sysfs attribute `/sys/class/nvme/nvmeN/address` (`nvme_sysfs_show_address` \u2192 `ctrl-\u003eops-\u003eget_address`), so the attacker must have local access to the host. A remote NVMe/TCP target or on-path attacker can drive the other half of the race (connection drop \u2192 `nvme_tcp_error_recovery_work` \u2192 `nvme_tcp_free_queue()`/`mutex_destroy` \u2192 reconnect `mutex_init`), but the vulnerable code itself is only reachable locally.\nAC:L - The attacker drives both sides of the race: an unlimited loop of `read()` on the world-readable address attribute plus repeated controller reset/reconnect cycles (root-triggered reset, or remotely induced error recovery by flapping the TCP connection), and the commit notes the window is hit by simple repetition of blktests nvme/014. A narrow window that can be retried indefinitely by the attacker is Low complexity.\nPR:L - The `address` attribute is declared `DEVICE_ATTR(address, S_IRUGO, ...)` (mode 0444), so any unprivileged local user can open and read it in a tight loop to enter `nvme_tcp_get_address()` and hit the destroyed/re-initialized `queue-\u003equeue_lock`. No capability, namespace, or CAP_SYS_ADMIN check exists on this path.\nUI:N - No victim action is needed \u2014 the attacker\u0027s own reads of the sysfs file supply the racing thread, and the teardown side occurs automatically on controller error recovery/reconnect. System daemons (udisksd, udev, nvme-cli) additionally read this attribute unprompted, as shown in the reported trace.\nS:U - The lock-lifetime bug and its consequences (WARN, hung task, released-socket access) are confined to the kernel of the affected host; no VM, IOMMU, or sandbox boundary is crossed. This is a standard same-authority kernel defect.\nC:H - `mutex_destroy()` in `nvme_tcp_free_queue()` and the subsequent `mutex_init()` in `nvme_tcp_alloc_queue()` on the same live memory void the mutual exclusion that commit 76d54bf20cdc added, re-opening access to a released socket: `kernel_getsockname(queue-\u003esock)` can run on a `struct socket` whose file was already `fput()`ed, reading freed memory whose contents are then formatted into the `src_addr=` string returned to the unprivileged reader. That is a use-after-free read with the leaked bytes delivered straight to userspace.\nI:H - The same use-after-free reaches an indirect call through `sock-\u003eops-\u003egetname` on freed memory, and `mutex_init()` resetting `owner`, `wait_lock`, and `wait_list` while another task holds or waits on the mutex corrupts the wait list \u2014 both give heap-grooming-based control-flow/write primitives per use-after-free scoring guidance.\nA:H - The reported and reproduced effect is a `DEBUG_LOCKS_WARN_ON(lock-\u003emagic != lock)` WARNING in `__mutex_lock()`, which is a panic on the many hardened/cloud kernels running `panic_on_warn`. The broken locking additionally yields NULL-pointer dereference of `queue-\u003esock`, use-after-free oopses, and orphaned mutex waiters that hang indefinitely."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T11:43:42.289Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/4f946479b326a3cbb193f2b8368aed9269514c35"
},
{
"url": "https://git.kernel.org/stable/c/975cb1d2121511584695d0e47fdb90e6782da007"
},
{
"url": "https://git.kernel.org/stable/c/e15cebc1b21856944b387f4abd03b66bd3d4f027"
},
{
"url": "https://git.kernel.org/stable/c/782373ba27660ba7d330208cf5509ece6feb4545"
}
],
"title": "nvme: tcp: avoid race between queue_lock lock and destroy",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2024-53100",
"datePublished": "2024-11-25T21:21:28.234Z",
"dateReserved": "2024-11-19T17:17:24.984Z",
"dateUpdated": "2026-08-05T11:43:42.289Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2024-53100",
"date": "2026-09-15",
"epss": "0.0017",
"percentile": "0.06643"
},
"fkie_nvd": {
"configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"6.1.118\", \"matchCriteriaId\": \"E978C1F9-A5F4-4892-83AE-94F6D3BEC908\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.2\", \"versionEndExcluding\": \"6.6.62\", \"matchCriteriaId\": \"EBACFAEF-9696-41C6-8B03-B3C5947DCB1D\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.7\", \"versionEndExcluding\": \"6.11.9\", \"matchCriteriaId\": \"759504D4-BE53-492C-BA9B-70F6A9F409CA\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.12:rc1:*:*:*:*:*:*\", \"matchCriteriaId\": \"7F361E1D-580F-4A2D-A509-7615F73167A1\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.12:rc2:*:*:*:*:*:*\", \"matchCriteriaId\": \"925478D0-3E3D-4E6F-ACD5-09F28D5DF82C\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.12:rc3:*:*:*:*:*:*\", \"matchCriteriaId\": \"3C95E234-D335-4B6C-96BF-E2CEBD8654ED\"}]}]}]",
"descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnvme: tcp: avoid race between queue_lock lock and destroy\\n\\nCommit 76d54bf20cdc (\\\"nvme-tcp: don\u0027t access released socket during\\nerror recovery\\\") added a mutex_lock() call for the queue-\u003equeue_lock\\nin nvme_tcp_get_address(). However, the mutex_lock() races with\\nmutex_destroy() in nvme_tcp_free_queue(), and causes the WARN below.\\n\\nDEBUG_LOCKS_WARN_ON(lock-\u003emagic != lock)\\nWARNING: CPU: 3 PID: 34077 at kernel/locking/mutex.c:587 __mutex_lock+0xcf0/0x1220\\nModules linked in: nvmet_tcp nvmet nvme_tcp nvme_fabrics iw_cm ib_cm ib_core pktcdvd nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 ip_set nf_tables qrtr sunrpc ppdev 9pnet_virtio 9pnet pcspkr netfs parport_pc parport e1000 i2c_piix4 i2c_smbus loop fuse nfnetlink zram bochs drm_vram_helper drm_ttm_helper ttm drm_kms_helper xfs drm sym53c8xx floppy nvme scsi_transport_spi nvme_core nvme_auth serio_raw ata_generic pata_acpi dm_multipath qemu_fw_cfg [last unloaded: ib_uverbs]\\nCPU: 3 UID: 0 PID: 34077 Comm: udisksd Not tainted 6.11.0-rc7 #319\\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-2.fc40 04/01/2014\\nRIP: 0010:__mutex_lock+0xcf0/0x1220\\nCode: 08 84 d2 0f 85 c8 04 00 00 8b 15 ef b6 c8 01 85 d2 0f 85 78 f4 ff ff 48 c7 c6 20 93 ee af 48 c7 c7 60 91 ee af e8 f0 a7 6d fd \u003c0f\u003e 0b e9 5e f4 ff ff 48 b8 00 00 00 00 00 fc ff df 4c 89 f2 48 c1\\nRSP: 0018:ffff88811305f760 EFLAGS: 00010286\\nRAX: 0000000000000000 RBX: ffff88812c652058 RCX: 0000000000000000\\nRDX: 0000000000000000 RSI: 0000000000000004 RDI: 0000000000000001\\nRBP: ffff88811305f8b0 R08: 0000000000000001 R09: ffffed1075c36341\\nR10: ffff8883ae1b1a0b R11: 0000000000010498 R12: 0000000000000000\\nR13: 0000000000000000 R14: dffffc0000000000 R15: ffff88812c652058\\nFS: 00007f9713ae4980(0000) GS:ffff8883ae180000(0000) knlGS:0000000000000000\\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\\nCR2: 00007fcd78483c7c CR3: 0000000122c38000 CR4: 00000000000006f0\\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\\nCall Trace:\\n \u003cTASK\u003e\\n ? __warn.cold+0x5b/0x1af\\n ? __mutex_lock+0xcf0/0x1220\\n ? report_bug+0x1ec/0x390\\n ? handle_bug+0x3c/0x80\\n ? exc_invalid_op+0x13/0x40\\n ? asm_exc_invalid_op+0x16/0x20\\n ? __mutex_lock+0xcf0/0x1220\\n ? nvme_tcp_get_address+0xc2/0x1e0 [nvme_tcp]\\n ? __pfx___mutex_lock+0x10/0x10\\n ? __lock_acquire+0xd6a/0x59e0\\n ? nvme_tcp_get_address+0xc2/0x1e0 [nvme_tcp]\\n nvme_tcp_get_address+0xc2/0x1e0 [nvme_tcp]\\n ? __pfx_nvme_tcp_get_address+0x10/0x10 [nvme_tcp]\\n nvme_sysfs_show_address+0x81/0xc0 [nvme_core]\\n dev_attr_show+0x42/0x80\\n ? __asan_memset+0x1f/0x40\\n sysfs_kf_seq_show+0x1f0/0x370\\n seq_read_iter+0x2cb/0x1130\\n ? rw_verify_area+0x3b1/0x590\\n ? __mutex_lock+0x433/0x1220\\n vfs_read+0x6a6/0xa20\\n ? lockdep_hardirqs_on+0x78/0x100\\n ? __pfx_vfs_read+0x10/0x10\\n ksys_read+0xf7/0x1d0\\n ? __pfx_ksys_read+0x10/0x10\\n ? __x64_sys_openat+0x105/0x1d0\\n do_syscall_64+0x93/0x180\\n ? lockdep_hardirqs_on_prepare+0x16d/0x400\\n ? do_syscall_64+0x9f/0x180\\n ? lockdep_hardirqs_on+0x78/0x100\\n ? do_syscall_64+0x9f/0x180\\n ? __pfx_ksys_read+0x10/0x10\\n ? lockdep_hardirqs_on_prepare+0x16d/0x400\\n ? do_syscall_64+0x9f/0x180\\n ? lockdep_hardirqs_on+0x78/0x100\\n ? do_syscall_64+0x9f/0x180\\n ? lockdep_hardirqs_on_prepare+0x16d/0x400\\n ? do_syscall_64+0x9f/0x180\\n ? lockdep_hardirqs_on+0x78/0x100\\n ? do_syscall_64+0x9f/0x180\\n ? lockdep_hardirqs_on_prepare+0x16d/0x400\\n ? do_syscall_64+0x9f/0x180\\n ? lockdep_hardirqs_on+0x78/0x100\\n ? do_syscall_64+0x9f/0x180\\n ? lockdep_hardirqs_on_prepare+0x16d/0x400\\n ? do_syscall_64+0x9f/0x180\\n ? lockdep_hardirqs_on+0x78/0x100\\n ? do_syscall_64+0x9f/0x180\\n ? do_syscall_64+0x9f/0x180\\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\\nRIP: 0033:0x7f9713f55cfa\\nCode: 55 48 89 e5 48 83 ec 20 48 89 55 e8 48 89 75 f0 89 7d f8 e8 e8 74 f8 ff 48 8b 55 e8 48 8b 75 f0 4\\n---truncated---\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: nvme: tcp: evitar la ejecuci\\u00f3n entre el bloqueo de queue_lock y la destrucci\\u00f3n. El commit 76d54bf20cdc (\\\"nvme-tcp: no acceder al socket liberado durante la recuperaci\\u00f3n de errores\\\") agreg\\u00f3 una llamada mutex_lock() para queue-\u0026gt;queue_lock en nvme_tcp_get_address(). Sin embargo, mutex_lock() compite con mutex_destroy() en nvme_tcp_free_queue() y provoca la siguiente ADVERTENCIA. DEBUG_LOCKS_WARN_ON(bloqueo-\u0026gt;m\\u00e1gico != bloqueo) ADVERTENCIA: CPU: 3 PID: 34077 en kernel/locking/mutex.c:587 __mutex_lock+0xcf0/0x1220 M\\u00f3dulos vinculados en: nvmet_tcp nvmet nvme_tcp nvme_fabrics iw_cm ib_cm ib_core pktcdvd nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 ip_set nf_tables qrtr sunrpc ppdev 9pnet_virtio 9pnet pcspkr netfs parport_pc parport e1000 i2c_piix4 i2c_smbus bucle fusible nfnetlink zram bochs drm_vram_helper drm_ttm_helper ttm drm_kms_helper xfs drm sym53c8xx disquete nvme scsi_transport_spi nvme_core nvme_auth serio_raw ata_generic pata_acpi dm_multipath qemu_fw_cfg [\\u00faltima descarga: ib_uverbs] CPU: 3 UID: 0 PID: 34077 Comm: udisksd No contaminado 6.11.0-rc7 #319 Nombre del hardware: PC est\\u00e1ndar QEMU (i440FX + PIIX, 1996), BIOS 1.16.3-2.fc40 01/04/2014 RIP: 0010:__mutex_lock+0xcf0/0x1220 C\\u00f3digo: 08 84 d2 0f 85 c8 04 00 00 8b 15 ef b6 c8 01 85 d2 0f 85 78 f4 ff ff 48 c7 c6 20 93 ee af 48 c7 c7 60 91 ee af e8 f0 a7 6d fd \u0026lt;0f\u0026gt; 0b e9 5e f4 ff ff 48 b8 00 00 00 00 00 fc ff df 4c 89 f2 48 c1 RSP: 0018:ffff88811305f760 EFLAGS: 00010286 RAX: 0000000000000000 RBX: ffff88812c652058 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000004 RDI: 0000000000000001 RBP: ffff88811305f8b0 R08: 0000000000000001 R09: ffffed1075c36341 R10: ffff8883ae1b1a0b R11: 0000000000010498 R12: 0000000000000000 R13: 0000000000000000 R14: dffffc0000000000 R15: ffff88812c652058 FS: 00007f9713ae4980(0000) GS:ffff8883ae180000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fcd78483c7c CR3: 0000000122c38000 CR4: 00000000000006f0 DR0: 0000000000000000 DR1: 00000000000000000 DR2: 00000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Seguimiento de llamadas: ? __warn.cold+0x5b/0x1af ? __mutex_lock+0xcf0/0x1220 ? report_bug+0x1ec/0x390 ? handle_bug+0x3c/0x80 ? exc_invalid_op+0x13/0x40 ? asm_exc_invalid_op+0x16/0x20 ? __mutex_lock+0xcf0/0x1220 ? __pfx___mutex_lock+0x10/0x10 ? __lock_acquire+0xd6a/0x59e0 ? nvme_tcp_get_address+0xc2/0x1e0 [nvme_tcp] nvme_tcp_get_address+0xc2/0x1e0 [nvme_tcp] ? __pfx_nvme_tcp_get_address+0x10/0x10 [nvme_tcp] nvme_sysfs_show_address+0x81/0xc0 [nvme_core] dev_attr_show+0x42/0x80 ? __asan_memset+0x1f/0x40 sysfs_kf_seq_show+0x1f0/0x370 seq_read_iter+0x2cb/0x1130 ? rw_verify_area+0x3b1/0x590 ? __mutex_lock+0x433/0x1220 vfs_read+0x6a6/0xa20 ? lockdep_hardirqs_on+0x78/0x100 ? __pfx_vfs_read+0x10/0x10 ksys_read+0xf7/0x1d0 ? __pfx_ksys_read+0x10/0x10 ? __pfx_ksys_read+0x10/0x10 ? lockdep_hardirqs_on_prepare+0x16d/0x400 ? lockdep_hardirqs_on_prepare+0x16d/0x400 ? hacer_syscall_64+0x9f/0x180 ? bloquear_hardirqs_en_preparar+0x16d/0x400 ? hacer_syscall_64+0x9f/0x180 ? bloquear_hardirqs_en+0x78/0x100 ? hacer_syscall_64+0x9f/0x180 ? bloquear_hardirqs_en_preparar+0x16d/0x400 ? hacer_syscall_64+0x9f/0x180 ? bloquear_hardirqs_en+0x78/0x100 ? hacer_syscall_64+0x9f/0x180 ? bloquear_hardirqs_en_preparar+0x16d/0x400 ? do_syscall_64+0x9f/0x180 ? lockdep_hardirqs_on+0x78/0x100 ? do_syscall_64+0x9f/0x180 ? do_syscall_64+0x9f/0x180 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7f9713f55cfa C\\u00f3digo: 55 48 89 e5 48 83 ec 20 48 89 55 e8 48 89 75 f0 89 7d f8 e8 e8 74 f8 ff 48 8b 55 e8 48 8b 75 f0 4 ---truncado---\"}]",
"id": "CVE-2024-53100",
"lastModified": "2024-12-24T15:52:44.583",
"metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"baseScore\": 4.7, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.0, \"impactScore\": 3.6}]}",
"published": "2024-11-25T22:15:16.763",
"references": "[{\"url\": \"https://git.kernel.org/stable/c/4f946479b326a3cbb193f2b8368aed9269514c35\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/782373ba27660ba7d330208cf5509ece6feb4545\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/975cb1d2121511584695d0e47fdb90e6782da007\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/e15cebc1b21856944b387f4abd03b66bd3d4f027\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}]",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"vulnStatus": "Analyzed",
"weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-362\"}]}]"
},
"microsoft_vex": {
"current_release_date": "2026-03-31T14:57:25.000Z",
"cve": "CVE-2024-53100",
"id": "msrc_CVE-2024-53100",
"initial_release_date": "2024-11-02T00:00:00.000Z",
"product_status:fixed": "2",
"product_status:known_affected": "2",
"product_status:under_investigation": "3",
"source": "Microsoft CSAF VEX",
"status": "final",
"title": "nvme: tcp: avoid race between queue_lock lock and destroy",
"url": "https://msrc.microsoft.com/csaf/vex/2024/msrc_cve-2024-53100.json",
"version": "3"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2024-53100\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-11-25T22:15:16.763\",\"lastModified\":\"2026-08-04T11:21:52.900\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnvme: tcp: avoid race between queue_lock lock and destroy\\n\\nCommit 76d54bf20cdc (\\\"nvme-tcp: don\u0027t access released socket during\\nerror recovery\\\") added a mutex_lock() call for the queue-\u003equeue_lock\\nin nvme_tcp_get_address(). However, the mutex_lock() races with\\nmutex_destroy() in nvme_tcp_free_queue(), and causes the WARN below.\\n\\nDEBUG_LOCKS_WARN_ON(lock-\u003emagic != lock)\\nWARNING: CPU: 3 PID: 34077 at kernel/locking/mutex.c:587 __mutex_lock+0xcf0/0x1220\\nModules linked in: nvmet_tcp nvmet nvme_tcp nvme_fabrics iw_cm ib_cm ib_core pktcdvd nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 ip_set nf_tables qrtr sunrpc ppdev 9pnet_virtio 9pnet pcspkr netfs parport_pc parport e1000 i2c_piix4 i2c_smbus loop fuse nfnetlink zram bochs drm_vram_helper drm_ttm_helper ttm drm_kms_helper xfs drm sym53c8xx floppy nvme scsi_transport_spi nvme_core nvme_auth serio_raw ata_generic pata_acpi dm_multipath qemu_fw_cfg [last unloaded: ib_uverbs]\\nCPU: 3 UID: 0 PID: 34077 Comm: udisksd Not tainted 6.11.0-rc7 #319\\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-2.fc40 04/01/2014\\nRIP: 0010:__mutex_lock+0xcf0/0x1220\\nCode: 08 84 d2 0f 85 c8 04 00 00 8b 15 ef b6 c8 01 85 d2 0f 85 78 f4 ff ff 48 c7 c6 20 93 ee af 48 c7 c7 60 91 ee af e8 f0 a7 6d fd \u003c0f\u003e 0b e9 5e f4 ff ff 48 b8 00 00 00 00 00 fc ff df 4c 89 f2 48 c1\\nRSP: 0018:ffff88811305f760 EFLAGS: 00010286\\nRAX: 0000000000000000 RBX: ffff88812c652058 RCX: 0000000000000000\\nRDX: 0000000000000000 RSI: 0000000000000004 RDI: 0000000000000001\\nRBP: ffff88811305f8b0 R08: 0000000000000001 R09: ffffed1075c36341\\nR10: ffff8883ae1b1a0b R11: 0000000000010498 R12: 0000000000000000\\nR13: 0000000000000000 R14: dffffc0000000000 R15: ffff88812c652058\\nFS: 00007f9713ae4980(0000) GS:ffff8883ae180000(0000) knlGS:0000000000000000\\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\\nCR2: 00007fcd78483c7c CR3: 0000000122c38000 CR4: 00000000000006f0\\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\\nCall Trace:\\n \u003cTASK\u003e\\n ? __warn.cold+0x5b/0x1af\\n ? __mutex_lock+0xcf0/0x1220\\n ? report_bug+0x1ec/0x390\\n ? handle_bug+0x3c/0x80\\n ? exc_invalid_op+0x13/0x40\\n ? asm_exc_invalid_op+0x16/0x20\\n ? __mutex_lock+0xcf0/0x1220\\n ? nvme_tcp_get_address+0xc2/0x1e0 [nvme_tcp]\\n ? __pfx___mutex_lock+0x10/0x10\\n ? __lock_acquire+0xd6a/0x59e0\\n ? nvme_tcp_get_address+0xc2/0x1e0 [nvme_tcp]\\n nvme_tcp_get_address+0xc2/0x1e0 [nvme_tcp]\\n ? __pfx_nvme_tcp_get_address+0x10/0x10 [nvme_tcp]\\n nvme_sysfs_show_address+0x81/0xc0 [nvme_core]\\n dev_attr_show+0x42/0x80\\n ? __asan_memset+0x1f/0x40\\n sysfs_kf_seq_show+0x1f0/0x370\\n seq_read_iter+0x2cb/0x1130\\n ? rw_verify_area+0x3b1/0x590\\n ? __mutex_lock+0x433/0x1220\\n vfs_read+0x6a6/0xa20\\n ? lockdep_hardirqs_on+0x78/0x100\\n ? __pfx_vfs_read+0x10/0x10\\n ksys_read+0xf7/0x1d0\\n ? __pfx_ksys_read+0x10/0x10\\n ? __x64_sys_openat+0x105/0x1d0\\n do_syscall_64+0x93/0x180\\n ? lockdep_hardirqs_on_prepare+0x16d/0x400\\n ? do_syscall_64+0x9f/0x180\\n ? lockdep_hardirqs_on+0x78/0x100\\n ? do_syscall_64+0x9f/0x180\\n ? __pfx_ksys_read+0x10/0x10\\n ? lockdep_hardirqs_on_prepare+0x16d/0x400\\n ? do_syscall_64+0x9f/0x180\\n ? lockdep_hardirqs_on+0x78/0x100\\n ? do_syscall_64+0x9f/0x180\\n ? lockdep_hardirqs_on_prepare+0x16d/0x400\\n ? do_syscall_64+0x9f/0x180\\n ? lockdep_hardirqs_on+0x78/0x100\\n ? do_syscall_64+0x9f/0x180\\n ? lockdep_hardirqs_on_prepare+0x16d/0x400\\n ? do_syscall_64+0x9f/0x180\\n ? lockdep_hardirqs_on+0x78/0x100\\n ? do_syscall_64+0x9f/0x180\\n ? lockdep_hardirqs_on_prepare+0x16d/0x400\\n ? do_syscall_64+0x9f/0x180\\n ? lockdep_hardirqs_on+0x78/0x100\\n ? do_syscall_64+0x9f/0x180\\n ? do_syscall_64+0x9f/0x180\\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\\nRIP: 0033:0x7f9713f55cfa\\nCode: 55 48 89 e5 48 83 ec 20 48 89 55 e8 48 89 75 f0 89 7d f8 e8 e8 74 f8 ff 48 8b 55 e8 48 8b 75 f0 4\\n---truncated---\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: nvme: tcp: evitar la ejecuci\u00f3n entre el bloqueo de queue_lock y la destrucci\u00f3n. El commit 76d54bf20cdc (\\\"nvme-tcp: no acceder al socket liberado durante la recuperaci\u00f3n de errores\\\") agreg\u00f3 una llamada mutex_lock() para queue-\u0026gt;queue_lock en nvme_tcp_get_address(). Sin embargo, mutex_lock() compite con mutex_destroy() en nvme_tcp_free_queue() y provoca la siguiente ADVERTENCIA. DEBUG_LOCKS_WARN_ON(bloqueo-\u0026gt;m\u00e1gico != bloqueo) ADVERTENCIA: CPU: 3 PID: 34077 en kernel/locking/mutex.c:587 __mutex_lock+0xcf0/0x1220 M\u00f3dulos vinculados en: nvmet_tcp nvmet nvme_tcp nvme_fabrics iw_cm ib_cm ib_core pktcdvd nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 ip_set nf_tables qrtr sunrpc ppdev 9pnet_virtio 9pnet pcspkr netfs parport_pc parport e1000 i2c_piix4 i2c_smbus bucle fusible nfnetlink zram bochs drm_vram_helper drm_ttm_helper ttm drm_kms_helper xfs drm sym53c8xx disquete nvme scsi_transport_spi nvme_core nvme_auth serio_raw ata_generic pata_acpi dm_multipath qemu_fw_cfg [\u00faltima descarga: ib_uverbs] CPU: 3 UID: 0 PID: 34077 Comm: udisksd No contaminado 6.11.0-rc7 #319 Nombre del hardware: PC est\u00e1ndar QEMU (i440FX + PIIX, 1996), BIOS 1.16.3-2.fc40 01/04/2014 RIP: 0010:__mutex_lock+0xcf0/0x1220 C\u00f3digo: 08 84 d2 0f 85 c8 04 00 00 8b 15 ef b6 c8 01 85 d2 0f 85 78 f4 ff ff 48 c7 c6 20 93 ee af 48 c7 c7 60 91 ee af e8 f0 a7 6d fd \u0026lt;0f\u0026gt; 0b e9 5e f4 ff ff 48 b8 00 00 00 00 00 fc ff df 4c 89 f2 48 c1 RSP: 0018:ffff88811305f760 EFLAGS: 00010286 RAX: 0000000000000000 RBX: ffff88812c652058 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000004 RDI: 0000000000000001 RBP: ffff88811305f8b0 R08: 0000000000000001 R09: ffffed1075c36341 R10: ffff8883ae1b1a0b R11: 0000000000010498 R12: 0000000000000000 R13: 0000000000000000 R14: dffffc0000000000 R15: ffff88812c652058 FS: 00007f9713ae4980(0000) GS:ffff8883ae180000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fcd78483c7c CR3: 0000000122c38000 CR4: 00000000000006f0 DR0: 0000000000000000 DR1: 00000000000000000 DR2: 00000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Seguimiento de llamadas: ? __warn.cold+0x5b/0x1af ? __mutex_lock+0xcf0/0x1220 ? report_bug+0x1ec/0x390 ? handle_bug+0x3c/0x80 ? exc_invalid_op+0x13/0x40 ? asm_exc_invalid_op+0x16/0x20 ? __mutex_lock+0xcf0/0x1220 ? __pfx___mutex_lock+0x10/0x10 ? __lock_acquire+0xd6a/0x59e0 ? nvme_tcp_get_address+0xc2/0x1e0 [nvme_tcp] nvme_tcp_get_address+0xc2/0x1e0 [nvme_tcp] ? __pfx_nvme_tcp_get_address+0x10/0x10 [nvme_tcp] nvme_sysfs_show_address+0x81/0xc0 [nvme_core] dev_attr_show+0x42/0x80 ? __asan_memset+0x1f/0x40 sysfs_kf_seq_show+0x1f0/0x370 seq_read_iter+0x2cb/0x1130 ? rw_verify_area+0x3b1/0x590 ? __mutex_lock+0x433/0x1220 vfs_read+0x6a6/0xa20 ? lockdep_hardirqs_on+0x78/0x100 ? __pfx_vfs_read+0x10/0x10 ksys_read+0xf7/0x1d0 ? __pfx_ksys_read+0x10/0x10 ? __pfx_ksys_read+0x10/0x10 ? lockdep_hardirqs_on_prepare+0x16d/0x400 ? lockdep_hardirqs_on_prepare+0x16d/0x400 ? hacer_syscall_64+0x9f/0x180 ? bloquear_hardirqs_en_preparar+0x16d/0x400 ? hacer_syscall_64+0x9f/0x180 ? bloquear_hardirqs_en+0x78/0x100 ? hacer_syscall_64+0x9f/0x180 ? bloquear_hardirqs_en_preparar+0x16d/0x400 ? hacer_syscall_64+0x9f/0x180 ? bloquear_hardirqs_en+0x78/0x100 ? hacer_syscall_64+0x9f/0x180 ? bloquear_hardirqs_en_preparar+0x16d/0x400 ? do_syscall_64+0x9f/0x180 ? lockdep_hardirqs_on+0x78/0x100 ? do_syscall_64+0x9f/0x180 ? do_syscall_64+0x9f/0x180 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7f9713f55cfa C\u00f3digo: 55 48 89 e5 48 83 ec 20 48 89 55 e8 48 89 75 f0 89 7d f8 e8 e8 74 f8 ff 48 8b 55 e8 48 8b 75 f0 4 ---truncado---\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/nvme/host/tcp.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"3f2304f8c6d6ed97849057bd16fee99e434ca796\",\"lessThan\":\"4f946479b326a3cbb193f2b8368aed9269514c35\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"3f2304f8c6d6ed97849057bd16fee99e434ca796\",\"lessThan\":\"975cb1d2121511584695d0e47fdb90e6782da007\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"3f2304f8c6d6ed97849057bd16fee99e434ca796\",\"lessThan\":\"e15cebc1b21856944b387f4abd03b66bd3d4f027\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"3f2304f8c6d6ed97849057bd16fee99e434ca796\",\"lessThan\":\"782373ba27660ba7d330208cf5509ece6feb4545\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/nvme/host/tcp.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.0\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.0\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.118\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.62\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.11.9\",\"lessThanOrEqual\":\"6.11.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":4.7,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.0,\"impactScore\":3.6},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":4.7,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.0,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2025-10-01T20:11:08.146191Z\",\"id\":\"CVE-2024-53100\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-362\"}]},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-362\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"6.1.118\",\"matchCriteriaId\":\"E978C1F9-A5F4-4892-83AE-94F6D3BEC908\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.62\",\"matchCriteriaId\":\"EBACFAEF-9696-41C6-8B03-B3C5947DCB1D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.11.9\",\"matchCriteriaId\":\"759504D4-BE53-492C-BA9B-70F6A9F409CA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.12:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"7F361E1D-580F-4A2D-A509-7615F73167A1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.12:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"925478D0-3E3D-4E6F-ACD5-09F28D5DF82C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.12:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"3C95E234-D335-4B6C-96BF-E2CEBD8654ED\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/4f946479b326a3cbb193f2b8368aed9269514c35\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/782373ba27660ba7d330208cf5509ece6feb4545\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/975cb1d2121511584695d0e47fdb90e6782da007\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e15cebc1b21856944b387f4abd03b66bd3d4f027\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
"redhat_vex": {
"aggregate_severity": "Moderate",
"current_release_date": "2026-08-04T14:03:01+00:00",
"cve": "CVE-2024-53100",
"id": "CVE-2024-53100",
"initial_release_date": "2024-11-25T00:00:00+00:00",
"product_status:known_affected": "156",
"product_status:known_not_affected": "42",
"source": "Red Hat CSAF VEX",
"status": "final",
"title": "kernel: nvme: tcp: avoid race between queue_lock lock and destroy",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-53100.json",
"version": "3"
},
"suse_vex": {
"aggregate_severity": "moderate",
"current_release_date": "2026-09-05T16:59:05Z",
"cve": "CVE-2024-53100",
"id": "CVE-2024-53100",
"initial_release_date": "2024-11-26T03:48:01Z",
"product_status:known_affected": "398",
"product_status:known_not_affected": "468",
"product_status:recommended": "280",
"source": "SUSE CSAF VEX",
"status": "interim",
"title": "SUSE CVE CVE-2024-53100",
"url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-53100.json",
"version": "55"
},
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 4.7, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"HIGH\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"NONE\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-53100\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-10-01T20:11:08.146191Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-362\", \"description\": \"CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-10-01T15:32:58.893Z\"}}], \"cna\": {\"title\": \"nvme: tcp: avoid race between queue_lock lock and destroy\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"3f2304f8c6d6ed97849057bd16fee99e434ca796\", \"lessThan\": \"4f946479b326a3cbb193f2b8368aed9269514c35\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"3f2304f8c6d6ed97849057bd16fee99e434ca796\", \"lessThan\": \"975cb1d2121511584695d0e47fdb90e6782da007\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"3f2304f8c6d6ed97849057bd16fee99e434ca796\", \"lessThan\": \"e15cebc1b21856944b387f4abd03b66bd3d4f027\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"3f2304f8c6d6ed97849057bd16fee99e434ca796\", \"lessThan\": \"782373ba27660ba7d330208cf5509ece6feb4545\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/nvme/host/tcp.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.0\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.0\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.1.118\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.62\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.11.9\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.11.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/nvme/host/tcp.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/4f946479b326a3cbb193f2b8368aed9269514c35\"}, {\"url\": \"https://git.kernel.org/stable/c/975cb1d2121511584695d0e47fdb90e6782da007\"}, {\"url\": \"https://git.kernel.org/stable/c/e15cebc1b21856944b387f4abd03b66bd3d4f027\"}, {\"url\": \"https://git.kernel.org/stable/c/782373ba27660ba7d330208cf5509ece6feb4545\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnvme: tcp: avoid race between queue_lock lock and destroy\\n\\nCommit 76d54bf20cdc (\\\"nvme-tcp: don\u0027t access released socket during\\nerror recovery\\\") added a mutex_lock() call for the queue-\u003equeue_lock\\nin nvme_tcp_get_address(). However, the mutex_lock() races with\\nmutex_destroy() in nvme_tcp_free_queue(), and causes the WARN below.\\n\\nDEBUG_LOCKS_WARN_ON(lock-\u003emagic != lock)\\nWARNING: CPU: 3 PID: 34077 at kernel/locking/mutex.c:587 __mutex_lock+0xcf0/0x1220\\nModules linked in: nvmet_tcp nvmet nvme_tcp nvme_fabrics iw_cm ib_cm ib_core pktcdvd nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 ip_set nf_tables qrtr sunrpc ppdev 9pnet_virtio 9pnet pcspkr netfs parport_pc parport e1000 i2c_piix4 i2c_smbus loop fuse nfnetlink zram bochs drm_vram_helper drm_ttm_helper ttm drm_kms_helper xfs drm sym53c8xx floppy nvme scsi_transport_spi nvme_core nvme_auth serio_raw ata_generic pata_acpi dm_multipath qemu_fw_cfg [last unloaded: ib_uverbs]\\nCPU: 3 UID: 0 PID: 34077 Comm: udisksd Not tainted 6.11.0-rc7 #319\\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-2.fc40 04/01/2014\\nRIP: 0010:__mutex_lock+0xcf0/0x1220\\nCode: 08 84 d2 0f 85 c8 04 00 00 8b 15 ef b6 c8 01 85 d2 0f 85 78 f4 ff ff 48 c7 c6 20 93 ee af 48 c7 c7 60 91 ee af e8 f0 a7 6d fd \u003c0f\u003e 0b e9 5e f4 ff ff 48 b8 00 00 00 00 00 fc ff df 4c 89 f2 48 c1\\nRSP: 0018:ffff88811305f760 EFLAGS: 00010286\\nRAX: 0000000000000000 RBX: ffff88812c652058 RCX: 0000000000000000\\nRDX: 0000000000000000 RSI: 0000000000000004 RDI: 0000000000000001\\nRBP: ffff88811305f8b0 R08: 0000000000000001 R09: ffffed1075c36341\\nR10: ffff8883ae1b1a0b R11: 0000000000010498 R12: 0000000000000000\\nR13: 0000000000000000 R14: dffffc0000000000 R15: ffff88812c652058\\nFS: 00007f9713ae4980(0000) GS:ffff8883ae180000(0000) knlGS:0000000000000000\\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\\nCR2: 00007fcd78483c7c CR3: 0000000122c38000 CR4: 00000000000006f0\\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\\nCall Trace:\\n \u003cTASK\u003e\\n ? __warn.cold+0x5b/0x1af\\n ? __mutex_lock+0xcf0/0x1220\\n ? report_bug+0x1ec/0x390\\n ? handle_bug+0x3c/0x80\\n ? exc_invalid_op+0x13/0x40\\n ? asm_exc_invalid_op+0x16/0x20\\n ? __mutex_lock+0xcf0/0x1220\\n ? nvme_tcp_get_address+0xc2/0x1e0 [nvme_tcp]\\n ? __pfx___mutex_lock+0x10/0x10\\n ? __lock_acquire+0xd6a/0x59e0\\n ? nvme_tcp_get_address+0xc2/0x1e0 [nvme_tcp]\\n nvme_tcp_get_address+0xc2/0x1e0 [nvme_tcp]\\n ? __pfx_nvme_tcp_get_address+0x10/0x10 [nvme_tcp]\\n nvme_sysfs_show_address+0x81/0xc0 [nvme_core]\\n dev_attr_show+0x42/0x80\\n ? __asan_memset+0x1f/0x40\\n sysfs_kf_seq_show+0x1f0/0x370\\n seq_read_iter+0x2cb/0x1130\\n ? rw_verify_area+0x3b1/0x590\\n ? __mutex_lock+0x433/0x1220\\n vfs_read+0x6a6/0xa20\\n ? lockdep_hardirqs_on+0x78/0x100\\n ? __pfx_vfs_read+0x10/0x10\\n ksys_read+0xf7/0x1d0\\n ? __pfx_ksys_read+0x10/0x10\\n ? __x64_sys_openat+0x105/0x1d0\\n do_syscall_64+0x93/0x180\\n ? lockdep_hardirqs_on_prepare+0x16d/0x400\\n ? do_syscall_64+0x9f/0x180\\n ? lockdep_hardirqs_on+0x78/0x100\\n ? do_syscall_64+0x9f/0x180\\n ? __pfx_ksys_read+0x10/0x10\\n ? lockdep_hardirqs_on_prepare+0x16d/0x400\\n ? do_syscall_64+0x9f/0x180\\n ? lockdep_hardirqs_on+0x78/0x100\\n ? do_syscall_64+0x9f/0x180\\n ? lockdep_hardirqs_on_prepare+0x16d/0x400\\n ? do_syscall_64+0x9f/0x180\\n ? lockdep_hardirqs_on+0x78/0x100\\n ? do_syscall_64+0x9f/0x180\\n ? lockdep_hardirqs_on_prepare+0x16d/0x400\\n ? do_syscall_64+0x9f/0x180\\n ? lockdep_hardirqs_on+0x78/0x100\\n ? do_syscall_64+0x9f/0x180\\n ? lockdep_hardirqs_on_prepare+0x16d/0x400\\n ? do_syscall_64+0x9f/0x180\\n ? lockdep_hardirqs_on+0x78/0x100\\n ? do_syscall_64+0x9f/0x180\\n ? do_syscall_64+0x9f/0x180\\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\\nRIP: 0033:0x7f9713f55cfa\\nCode: 55 48 89 e5 48 83 ec 20 48 89 55 e8 48 89 75 f0 89 7d f8 e8 e8 74 f8 ff 48 8b 55 e8 48 8b 75 f0 4\\n---truncated---\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.118\", \"versionStartIncluding\": \"5.0\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.62\", \"versionStartIncluding\": \"5.0\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.11.9\", \"versionStartIncluding\": \"5.0\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12\", \"versionStartIncluding\": \"5.0\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2025-07-11T17:21:29.190Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2024-53100\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-10-01T20:17:12.464Z\", \"dateReserved\": \"2024-11-19T17:17:24.984Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-11-25T21:21:28.234Z\", \"assignerShortName\": \"Linux\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
}
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Loading…
Loading…