{"id":"CVE-2024-50079","summary":"io_uring/sqpoll: ensure task state is TASK_RUNNING when running task_work","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/sqpoll: ensure task state is TASK_RUNNING when running task_work\n\nWhen the sqpoll is exiting and cancels pending work items, it may need\nto run task_work. If this happens from within io_uring_cancel_generic(),\nthen it may be under waiting for the io_uring_task waitqueue. This\nresults in the below splat from the scheduler, as the ring mutex may be\nattempted grabbed while in a TASK_INTERRUPTIBLE state.\n\nEnsure that the task state is set appropriately for that, just like what\nis done for the other cases in io_run_task_work().\n\ndo not call blocking ops when !TASK_RUNNING; state=1 set at [\u003c0000000029387fd2\u003e] prepare_to_wait+0x88/0x2fc\nWARNING: CPU: 6 PID: 59939 at kernel/sched/core.c:8561 __might_sleep+0xf4/0x140\nModules linked in:\nCPU: 6 UID: 0 PID: 59939 Comm: iou-sqp-59938 Not tainted 6.12.0-rc3-00113-g8d020023b155 #7456\nHardware name: linux,dummy-virt (DT)\npstate: 61400005 (nZCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--)\npc : __might_sleep+0xf4/0x140\nlr : __might_sleep+0xf4/0x140\nsp : ffff80008c5e7830\nx29: ffff80008c5e7830 x28: ffff0000d93088c0 x27: ffff60001c2d7230\nx26: dfff800000000000 x25: ffff0000e16b9180 x24: ffff80008c5e7a50\nx23: 1ffff000118bcf4a x22: ffff0000e16b9180 x21: ffff0000e16b9180\nx20: 000000000000011b x19: ffff80008310fac0 x18: 1ffff000118bcd90\nx17: 30303c5b20746120 x16: 74657320313d6574 x15: 0720072007200720\nx14: 0720072007200720 x13: 0720072007200720 x12: ffff600036c64f0b\nx11: 1fffe00036c64f0a x10: ffff600036c64f0a x9 : dfff800000000000\nx8 : 00009fffc939b0f6 x7 : ffff0001b6327853 x6 : 0000000000000001\nx5 : ffff0001b6327850 x4 : ffff600036c64f0b x3 : ffff8000803c35bc\nx2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff0000e16b9180\nCall trace:\n __might_sleep+0xf4/0x140\n mutex_lock+0x84/0x124\n io_handle_tw_list+0xf4/0x260\n tctx_task_work_run+0x94/0x340\n io_run_task_work+0x1ec/0x3c0\n io_uring_cancel_generic+0x364/0x524\n io_sq_thread+0x820/0x124c\n ret_from_fork+0x10/0x20","modified":"2026-03-20T12:39:34.504673Z","published":"2024-10-29T00:50:21.508Z","related":["USN-7276-1","USN-7277-1","openSUSE-SU-2024:14500-1","openSUSE-SU-2025:14705-1"],"database_specific":{"cna_assigner":"Linux","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/50xxx/CVE-2024-50079.json"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/887ba598d9cfb537bdb3dfd95f087ff8a08cb74d"},{"type":"WEB","url":"https://git.kernel.org/stable/c/8f7033aa4089fbaf7a33995f0f2ee6c9d7b9ca1b"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/50xxx/CVE-2024-50079.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-50079"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"af5d68f8892f8ee8f137648b79ceb2abc153a19b"},{"fixed":"887ba598d9cfb537bdb3dfd95f087ff8a08cb74d"},{"fixed":"8f7033aa4089fbaf7a33995f0f2ee6c9d7b9ca1b"}]}],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-50079.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}]}