CVE-2024-26764

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> fs/aio: Restrict kiocb_set_cancel_fn() to I/O submitted via libaio<br /> <br /> If kiocb_set_cancel_fn() is called for I/O submitted via io_uring, the<br /> following kernel warning appears:<br /> <br /> WARNING: CPU: 3 PID: 368 at fs/aio.c:598 kiocb_set_cancel_fn+0x9c/0xa8<br /> Call trace:<br /> kiocb_set_cancel_fn+0x9c/0xa8<br /> ffs_epfile_read_iter+0x144/0x1d0<br /> io_read+0x19c/0x498<br /> io_issue_sqe+0x118/0x27c<br /> io_submit_sqes+0x25c/0x5fc<br /> __arm64_sys_io_uring_enter+0x104/0xab0<br /> invoke_syscall+0x58/0x11c<br /> el0_svc_common+0xb4/0xf4<br /> do_el0_svc+0x2c/0xb0<br /> el0_svc+0x2c/0xa4<br /> el0t_64_sync_handler+0x68/0xb4<br /> el0t_64_sync+0x1a4/0x1a8<br /> <br /> Fix this by setting the IOCB_AIO_RW flag for read and write I/O that is<br /> submitted by libaio.