{"id":"DEBIAN-CVE-2024-50140","details":"In the Linux kernel, the following vulnerability has been resolved:  sched/core: Disable page allocation in task_tick_mm_cid()  With KASAN and PREEMPT_RT enabled, calling task_work_add() in task_tick_mm_cid() may cause the following splat.  [   63.696416] BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:48 [   63.696416] in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 610, name: modprobe [   63.696416] preempt_count: 10001, expected: 0 [   63.696416] RCU nest depth: 1, expected: 1  This problem is caused by the following call trace.    sched_tick() [ acquire rq-\u003e__lock ]    -\u003e task_tick_mm_cid()     -\u003e task_work_add()      -\u003e __kasan_record_aux_stack()       -\u003e kasan_save_stack()        -\u003e stack_depot_save_flags()         -\u003e alloc_pages_mpol_noprof()          -\u003e __alloc_pages_noprof() \t  -\u003e get_page_from_freelist() \t   -\u003e rmqueue() \t    -\u003e rmqueue_pcplist() \t     -\u003e __rmqueue_pcplist() \t      -\u003e rmqueue_bulk() \t       -\u003e rt_spin_lock()  The rq lock is a raw_spinlock_t. We can't sleep while holding it. IOW, we can't call alloc_pages() in stack_depot_save_flags().  The task_tick_mm_cid() function with its task_work_add() call was introduced by commit 223baf9d17f2 (\"sched: Fix performance regression introduced by mm_cid\") in v6.4 kernel.  Fortunately, there is a kasan_record_aux_stack_noalloc() variant that calls stack_depot_save_flags() while not allowing it to allocate new pages.  To allow task_tick_mm_cid() to use task_work without page allocation, a new TWAF_NO_ALLOC flag is added to enable calling kasan_record_aux_stack_noalloc() instead of kasan_record_aux_stack() if set. The task_tick_mm_cid() function is modified to add this new flag.  The possible downside is the missing stack trace in a KASAN report due to new page allocation required when task_work_add_noallloc() is called which should be rare.","modified":"2026-09-15T09:02:58.957939038Z","published":"2024-11-07T10:15:05.980Z","upstream":["CVE-2024-50140"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2024-50140"}],"affected":[{"package":{"name":"linux","ecosystem":"Debian:13","purl":"pkg:deb/debian/linux?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.11.6-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2024-50140.json"}},{"package":{"name":"linux","ecosystem":"Debian:14","purl":"pkg:deb/debian/linux?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.11.6-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2024-50140.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}]}