What’s Vulnerable › Vulnerabilities

CVE-2024-35998: smb3: fix lock ordering potential deadlock in cifs_sync_mid_result

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-05-20 · updated 2026-08-04
• Weakness: CWE-667

Description

In the Linux kernel, the following vulnerability has been resolved: smb3: fix lock ordering potential deadlock in cifs_sync_mid_result Coverity spotted that the cifs_sync_mid_result function could deadlock "Thread deadlock (ORDER_REVERSAL) lock_order: Calling spin_lock acquires lock TCP_Server_Info.srv_lock while holding lock TCP_Server_Info.mid_lock" Addresses-Coverity: 1590401 ("Thread deadlock (ORDER_REVERSAL)")

Affected products

• Linux kernel: before 6.1.90; from 6.2 before 6.6.30; from 6.7 before 6.8.9; 6.9-rc1, 6.9-rc2, 6.9-rc3, 6.9-rc4, 6.9-rc5 — fixed in 6.1.90, 6.6.30, 6.8.9

How to fix

Upgrade to a fixed version: Linux kernel 6.1.90, 6.6.30, 6.8.9. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/699f8958dece132709c0bff6a9700999a2a63b75
• https://git.kernel.org/stable/c/8248224ab5b8ca7559b671917c224296a4d671fc
• https://git.kernel.org/stable/c/8861fd5180476f45f9e8853db154600469a0284f
• https://git.kernel.org/stable/c/c7a4bca289e50bb4b2650f845c41bb3e453f4c66
• https://git.kernel.org/stable/c/699f8958dece132709c0bff6a9700999a2a63b75
• https://git.kernel.org/stable/c/8248224ab5b8ca7559b671917c224296a4d671fc
• https://git.kernel.org/stable/c/8861fd5180476f45f9e8853db154600469a0284f
• https://git.kernel.org/stable/c/c7a4bca289e50bb4b2650f845c41bb3e453f4c66

Get alerted when CVE-2024-35998 or the next vulnerability affects your stack