CVE-2024-47660

Severity CVSS v4.0:
Pending analysis
Type:
CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Publication date:
09/10/2024
Last modified:
03/11/2025

Description

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> fsnotify: clear PARENT_WATCHED flags lazily<br /> <br /> In some setups directories can have many (usually negative) dentries.<br /> Hence __fsnotify_update_child_dentry_flags() function can take a<br /> significant amount of time. Since the bulk of this function happens<br /> under inode-&gt;i_lock this causes a significant contention on the lock<br /> when we remove the watch from the directory as the<br /> __fsnotify_update_child_dentry_flags() call from fsnotify_recalc_mask()<br /> races with __fsnotify_update_child_dentry_flags() calls from<br /> __fsnotify_parent() happening on children. This can lead upto softlockup<br /> reports reported by users.<br /> <br /> Fix the problem by calling fsnotify_update_children_dentry_flags() to<br /> set PARENT_WATCHED flags only when parent starts watching children.<br /> <br /> When parent stops watching children, clear false positive PARENT_WATCHED<br /> flags lazily in __fsnotify_parent() for each accessed child.

Vulnerable products and versions

CPE From Up to
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 5.10.226 (excluding)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 5.11 (including) 5.15.167 (excluding)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 5.16 (including) 6.1.109 (excluding)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 6.2 (including) 6.6.50 (excluding)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 6.7 (including) 6.10.9 (excluding)