CVE-2024-56584: io_uring/tctx: work around xa_store() allocation error issue

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-12-27 · updated 2026-06-17
Weakness: CWE-770

Description

In the Linux kernel, the following vulnerability has been resolved: io_uring/tctx: work around xa_store() allocation error issue syzbot triggered the following WARN_ON: WARNING: CPU: 0 PID: 16 at io_uring/tctx.c:51 __io_uring_free+0xfa/0x140 io_uring/tctx.c:51 which is the WARN_ON_ONCE(!xa_empty(&tctx->xa)); sanity check in __io_uring_free() when a io_uring_task is going through its final put. The syzbot test case includes injecting memory allocation failures, and it very much looks like xa_store() can fail one of its memory allocations and end up with ->head being non-NULL even though no entries exist in the xarray. Until this issue gets sorted out, work around it by attempting to iterate entries in our xarray, and WARN_ON_ONCE() if one is found.

Affected products

Linux kernel: from 5.1 before 6.1.120; from 6.2 before 6.6.66; from 6.7 before 6.12.5 — fixed in 6.1.120, 6.12.5, 6.6.66

How to fix

Upgrade to a fixed version: Linux kernel 6.1.120, 6.12.5, 6.6.66. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2024-56584 or the next vulnerability affects your stack