{"id":"CVE-2024-26671","summary":"blk-mq: fix IO hang from sbitmap wakeup race","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nblk-mq: fix IO hang from sbitmap wakeup race\n\nIn blk_mq_mark_tag_wait(), __add_wait_queue() may be re-ordered\nwith the following blk_mq_get_driver_tag() in case of getting driver\ntag failure.\n\nThen in __sbitmap_queue_wake_up(), waitqueue_active() may not observe\nthe added waiter in blk_mq_mark_tag_wait() and wake up nothing, meantime\nblk_mq_mark_tag_wait() can't get driver tag successfully.\n\nThis issue can be reproduced by running the following test in loop, and\nfio hang can be observed in \u003c 30min when running it on my test VM\nin laptop.\n\n\tmodprobe -r scsi_debug\n\tmodprobe scsi_debug delay=0 dev_size_mb=4096 max_queue=1 host_max_queue=1 submit_queues=4\n\tdev=`ls -d /sys/bus/pseudo/drivers/scsi_debug/adapter*/host*/target*/*/block/* | head -1 | xargs basename`\n\tfio --filename=/dev/\"$dev\" --direct=1 --rw=randrw --bs=4k --iodepth=1 \\\n       \t\t--runtime=100 --numjobs=40 --time_based --name=test \\\n        \t--ioengine=libaio\n\nFix the issue by adding one explicit barrier in blk_mq_mark_tag_wait(), which\nis just fine in case of running out of tag.","modified":"2026-03-20T12:35:07.183548Z","published":"2024-04-02T06:49:13.834Z","related":["SUSE-SU-2024:1643-1","SUSE-SU-2024:1644-1","SUSE-SU-2024:1646-1","SUSE-SU-2024:1659-1","SUSE-SU-2024:1663-1","SUSE-SU-2024:1870-1","SUSE-SU-2024:2135-1","SUSE-SU-2024:2203-1","SUSE-SU-2024:2973-1","SUSE-SU-2025:20008-1","SUSE-SU-2025:20028-1","USN-6818-2","USN-6819-2"],"database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/26xxx/CVE-2024-26671.json","cna_assigner":"Linux"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/1d9c777d3e70bdc57dddf7a14a80059d65919e56"},{"type":"WEB","url":"https://git.kernel.org/stable/c/5266caaf5660529e3da53004b8b7174cab6374ed"},{"type":"WEB","url":"https://git.kernel.org/stable/c/6d8b01624a2540336a32be91f25187a433af53a0"},{"type":"WEB","url":"https://git.kernel.org/stable/c/7610ba1319253225a9ba8a9d28d472fc883b4e2f"},{"type":"WEB","url":"https://git.kernel.org/stable/c/89e0e66682e1538aeeaa3109503473663cd24c8b"},{"type":"WEB","url":"https://git.kernel.org/stable/c/9525b38180e2753f0daa1a522b7767a2aa969676"},{"type":"WEB","url":"https://git.kernel.org/stable/c/ecd7744a1446eb02ccc63e493e2eb6ede4ef1e10"},{"type":"WEB","url":"https://git.kernel.org/stable/c/f1bc0d8163f8ee84a8d5affdf624cfad657df1d2"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/26xxx/CVE-2024-26671.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26671"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"da55f2cc78418dee88400aafbbaed19d7ac8188e"},{"fixed":"9525b38180e2753f0daa1a522b7767a2aa969676"},{"fixed":"ecd7744a1446eb02ccc63e493e2eb6ede4ef1e10"},{"fixed":"7610ba1319253225a9ba8a9d28d472fc883b4e2f"},{"fixed":"89e0e66682e1538aeeaa3109503473663cd24c8b"},{"fixed":"1d9c777d3e70bdc57dddf7a14a80059d65919e56"},{"fixed":"6d8b01624a2540336a32be91f25187a433af53a0"},{"fixed":"f1bc0d8163f8ee84a8d5affdf624cfad657df1d2"},{"fixed":"5266caaf5660529e3da53004b8b7174cab6374ed"}]}],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-26671.json"}}],"schema_version":"1.7.5"}