{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2024-56641", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-12-27T15:00:39.839Z", "datePublished": "2024-12-27T15:02:42.958Z", "dateUpdated": "2026-08-05T11:45:40.041Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:45:40.041Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/smc: initialize close_work early to avoid warning\n\nWe encountered a warning that close_work was canceled before\ninitialization.\n\n WARNING: CPU: 7 PID: 111103 at kernel/workqueue.c:3047 __flush_work+0x19e/0x1b0\n Workqueue: events smc_lgr_terminate_work [smc]\n RIP: 0010:__flush_work+0x19e/0x1b0\n Call Trace:\n ? __wake_up_common+0x7a/0x190\n ? work_busy+0x80/0x80\n __cancel_work_timer+0xe3/0x160\n smc_close_cancel_work+0x1a/0x70 [smc]\n smc_close_active_abort+0x207/0x360 [smc]\n __smc_lgr_terminate.part.38+0xc8/0x180 [smc]\n process_one_work+0x19e/0x340\n worker_thread+0x30/0x370\n ? process_one_work+0x340/0x340\n kthread+0x117/0x130\n ? __kthread_cancel_work+0x50/0x50\n ret_from_fork+0x22/0x30\n\nThis is because when smc_close_cancel_work is triggered, e.g. the RDMA\ndriver is rmmod and the LGR is terminated, the conn->close_work is\nflushed before initialization, resulting in WARN_ON(!work->func).\n\n__smc_lgr_terminate | smc_connect_{rdma|ism}\n-------------------------------------------------------------\n | smc_conn_create\n\t\t\t\t| \\- smc_lgr_register_conn\nfor conn in lgr->conns_all |\n\\- smc_conn_kill |\n \\- smc_close_active_abort |\n \\- smc_close_cancel_work |\n \\- cancel_work_sync |\n \\- __flush_work |\n\t (close_work) |\n\t | smc_close_init\n\t | \\- INIT_WORK(&close_work)\n\nSo fix this by initializing close_work before establishing the\nconnection." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:N - The affected code is the SMC (Shared Memory Communications) protocol connect path, driven entirely by a remote peer's CLC/LLC messages, and the racing link-group teardown is itself triggerable by peer-sent LLC DELETE_LINK(ALL), LLC protocol violations, or a CLC DECLINE with the first-contact flag. No local access to the target is required for the attacking peer.\nAC:L - The remote peer controls both sides of the race — it dictates when the client executes smc_conn_create() by timing its CLC Accept reply, and it can force __smc_lgr_terminate() at will via an LLC DELETE_LINK ALL or protocol violation — and it can retry across the many connections an LGR multiplexes until the window is hit.\nPR:N - SMC performs no authentication of its own; a peer completing the ordinary TCP/CLC handshake needs no credentials or privileges on the target system. Locally, AF_SMC socket creation also has no capability check in smc_create()/__smc_create().\nUI:N - The condition is hit during normal, automatic SMC connection establishment and link-group termination handling; no victim action such as opening a file or mounting anything is needed.\nS:U - The warning and any resulting panic occur in the kernel's own SMC/workqueue context, with no crossing of a virtualization, IOMMU, or other security-authority boundary.\nC:N - __flush_work() returns immediately at WARN_ON(!work->func) without dereferencing or exposing any data; there is no out-of-bounds read, uninitialized-memory disclosure, or pointer leak beyond the standard splat.\nI:N - No memory is corrupted — close_work is zero-initialized and was never queued, so the aborted cancel leaves no dangling state and provides no write primitive or control-flow influence.\nA:H - The WARN_ON is a kernel warning raised from the smc_lgr_terminate_work worker, which panics the system outright on the widely deployed panic_on_warn=1 configuration and can be triggered repeatedly by the peer, yielding a remote denial of service." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "net/smc/af_smc.c" ], "versions": [ { "version": "46c28dbd4c23c3f7fa37f5ea48772af79c9cc40e", "lessThan": "f0c37002210aaede10dae849d1a78efc2243add2", "status": "affected", "versionType": "git" }, { "version": "46c28dbd4c23c3f7fa37f5ea48772af79c9cc40e", "lessThan": "6638e52dcfafaf1b9cbc34544f0c832db0069ea1", "status": "affected", "versionType": "git" }, { "version": "46c28dbd4c23c3f7fa37f5ea48772af79c9cc40e", "lessThan": "0541db8ee32c09463a72d0987382b3a3336b0043", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "net/smc/af_smc.c" ], "versions": [ { "version": "4.12", "status": "affected" }, { "version": "0", "lessThan": "4.12", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.66", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.5", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.13", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.12", "versionEndExcluding": "6.6.66" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.12", "versionEndExcluding": "6.12.5" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.12", "versionEndExcluding": "6.13" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/f0c37002210aaede10dae849d1a78efc2243add2" }, { "url": "https://git.kernel.org/stable/c/6638e52dcfafaf1b9cbc34544f0c832db0069ea1" }, { "url": "https://git.kernel.org/stable/c/0541db8ee32c09463a72d0987382b3a3336b0043" } ], "title": "net/smc: initialize close_work early to avoid warning", "x_generator": { "engine": "bippy-1.2.0" } } } }