CVE-2024-43892 (GCVE-0-2024-43892)

Vulnerability from cvelistv5 – Published: 2024-08-26 10:10 – Updated: 2026-05-23 15:53
VLAI
Title
memcg: protect concurrent access to mem_cgroup_idr
Summary
In the Linux kernel, the following vulnerability has been resolved: memcg: protect concurrent access to mem_cgroup_idr Commit 73f576c04b94 ("mm: memcontrol: fix cgroup creation failure after many small jobs") decoupled the memcg IDs from the CSS ID space to fix the cgroup creation failures. It introduced IDR to maintain the memcg ID space. The IDR depends on external synchronization mechanisms for modifications. For the mem_cgroup_idr, the idr_alloc() and idr_replace() happen within css callback and thus are protected through cgroup_mutex from concurrent modifications. However idr_remove() for mem_cgroup_idr was not protected against concurrency and can be run concurrently for different memcgs when they hit their refcnt to zero. Fix that. We have been seeing list_lru based kernel crashes at a low frequency in our fleet for a long time. These crashes were in different part of list_lru code including list_lru_add(), list_lru_del() and reparenting code. Upon further inspection, it looked like for a given object (dentry and inode), the super_block's list_lru didn't have list_lru_one for the memcg of that object. The initial suspicions were either the object is not allocated through kmem_cache_alloc_lru() or somehow memcg_list_lru_alloc() failed to allocate list_lru_one() for a memcg but returned success. No evidence were found for these cases. Looking more deeply, we started seeing situations where valid memcg's id is not present in mem_cgroup_idr and in some cases multiple valid memcgs have same id and mem_cgroup_idr is pointing to one of them. So, the most reasonable explanation is that these situations can happen due to race between multiple idr_remove() calls or race between idr_alloc()/idr_replace() and idr_remove(). These races are causing multiple memcgs to acquire the same ID and then offlining of one of them would cleanup list_lrus on the system for all of them. Later access from other memcgs to the list_lru cause crashes due to missing list_lru_one.
Severity
No CVSS data available.
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator (v2.0.3)
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 73f576c04b9410ed19660f74f97521bee6e1c546 , < 912736a0435ef40e6a4ae78197ccb5553cb80b05 (git)
Affected: 73f576c04b9410ed19660f74f97521bee6e1c546 , < e6cc9ff2ac0b5df9f25eb790934c3104f6710278 (git)
Affected: 73f576c04b9410ed19660f74f97521bee6e1c546 , < 56fd70f4aa8b82199dbe7e99366b1fd7a04d86fb (git)
Affected: 73f576c04b9410ed19660f74f97521bee6e1c546 , < 37a060b64ae83b76600d187d76591ce488ab836b (git)
Affected: 73f576c04b9410ed19660f74f97521bee6e1c546 , < 51c0b1bb7541f8893ec1accba59eb04361a70946 (git)
Affected: 73f576c04b9410ed19660f74f97521bee6e1c546 , < 9972605a238339b85bd16b084eed5f18414d22db (git)
Affected: 8627c7750a66a46d56d3564e1e881aa53764497c (git)
Affected: db70cd18d3da727a3a59694de428a9e41c620de7 (git)
Affected: 4.4.18 , < 4.5 (semver)
Affected: 4.6.6 , < 4.7 (semver)
Create a notification for this product.
Linux Linux Affected: 4.7
Unaffected: 0 , < 4.7 (semver)
Unaffected: 5.10.226 , ≤ 5.10.* (semver)
Unaffected: 5.15.167 , ≤ 5.15.* (semver)
Unaffected: 6.1.110 , ≤ 6.1.* (semver)
Unaffected: 6.6.46 , ≤ 6.6.* (semver)
Unaffected: 6.10.5 , ≤ 6.10.* (semver)
Unaffected: 6.11 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-43892",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T15:29:18.942187Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-12T17:32:57.970Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T22:06:51.189Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2024/10/msg00003.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "mm/memcontrol.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "912736a0435ef40e6a4ae78197ccb5553cb80b05",
              "status": "affected",
              "version": "73f576c04b9410ed19660f74f97521bee6e1c546",
              "versionType": "git"
            },
            {
              "lessThan": "e6cc9ff2ac0b5df9f25eb790934c3104f6710278",
              "status": "affected",
              "version": "73f576c04b9410ed19660f74f97521bee6e1c546",
              "versionType": "git"
            },
            {
              "lessThan": "56fd70f4aa8b82199dbe7e99366b1fd7a04d86fb",
              "status": "affected",
              "version": "73f576c04b9410ed19660f74f97521bee6e1c546",
              "versionType": "git"
            },
            {
              "lessThan": "37a060b64ae83b76600d187d76591ce488ab836b",
              "status": "affected",
              "version": "73f576c04b9410ed19660f74f97521bee6e1c546",
              "versionType": "git"
            },
            {
              "lessThan": "51c0b1bb7541f8893ec1accba59eb04361a70946",
              "status": "affected",
              "version": "73f576c04b9410ed19660f74f97521bee6e1c546",
              "versionType": "git"
            },
            {
              "lessThan": "9972605a238339b85bd16b084eed5f18414d22db",
              "status": "affected",
              "version": "73f576c04b9410ed19660f74f97521bee6e1c546",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "8627c7750a66a46d56d3564e1e881aa53764497c",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "db70cd18d3da727a3a59694de428a9e41c620de7",
              "versionType": "git"
            },
            {
              "lessThan": "4.5",
              "status": "affected",
              "version": "4.4.18",
              "versionType": "semver"
            },
            {
              "lessThan": "4.7",
              "status": "affected",
              "version": "4.6.6",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "mm/memcontrol.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.7"
            },
            {
              "lessThan": "4.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.226",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.167",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.110",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.46",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.10.*",
              "status": "unaffected",
              "version": "6.10.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.11",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.226",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.167",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.110",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.46",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10.5",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.6.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmemcg: protect concurrent access to mem_cgroup_idr\n\nCommit 73f576c04b94 (\"mm: memcontrol: fix cgroup creation failure after\nmany small jobs\") decoupled the memcg IDs from the CSS ID space to fix the\ncgroup creation failures.  It introduced IDR to maintain the memcg ID\nspace.  The IDR depends on external synchronization mechanisms for\nmodifications.  For the mem_cgroup_idr, the idr_alloc() and idr_replace()\nhappen within css callback and thus are protected through cgroup_mutex\nfrom concurrent modifications.  However idr_remove() for mem_cgroup_idr\nwas not protected against concurrency and can be run concurrently for\ndifferent memcgs when they hit their refcnt to zero.  Fix that.\n\nWe have been seeing list_lru based kernel crashes at a low frequency in\nour fleet for a long time.  These crashes were in different part of\nlist_lru code including list_lru_add(), list_lru_del() and reparenting\ncode.  Upon further inspection, it looked like for a given object (dentry\nand inode), the super_block\u0027s list_lru didn\u0027t have list_lru_one for the\nmemcg of that object.  The initial suspicions were either the object is\nnot allocated through kmem_cache_alloc_lru() or somehow\nmemcg_list_lru_alloc() failed to allocate list_lru_one() for a memcg but\nreturned success.  No evidence were found for these cases.\n\nLooking more deeply, we started seeing situations where valid memcg\u0027s id\nis not present in mem_cgroup_idr and in some cases multiple valid memcgs\nhave same id and mem_cgroup_idr is pointing to one of them.  So, the most\nreasonable explanation is that these situations can happen due to race\nbetween multiple idr_remove() calls or race between\nidr_alloc()/idr_replace() and idr_remove().  These races are causing\nmultiple memcgs to acquire the same ID and then offlining of one of them\nwould cleanup list_lrus on the system for all of them.  Later access from\nother memcgs to the list_lru cause crashes due to missing list_lru_one."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-23T15:53:10.333Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/912736a0435ef40e6a4ae78197ccb5553cb80b05"
        },
        {
          "url": "https://git.kernel.org/stable/c/e6cc9ff2ac0b5df9f25eb790934c3104f6710278"
        },
        {
          "url": "https://git.kernel.org/stable/c/56fd70f4aa8b82199dbe7e99366b1fd7a04d86fb"
        },
        {
          "url": "https://git.kernel.org/stable/c/37a060b64ae83b76600d187d76591ce488ab836b"
        },
        {
          "url": "https://git.kernel.org/stable/c/51c0b1bb7541f8893ec1accba59eb04361a70946"
        },
        {
          "url": "https://git.kernel.org/stable/c/9972605a238339b85bd16b084eed5f18414d22db"
        }
      ],
      "title": "memcg: protect concurrent access to mem_cgroup_idr",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-43892",
    "datePublished": "2024-08-26T10:10:46.612Z",
    "dateReserved": "2024-08-17T09:11:59.290Z",
    "dateUpdated": "2026-05-23T15:53:10.333Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-43892",
      "date": "2026-06-02",
      "epss": "9e-05",
      "percentile": "0.00972"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-43892\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-08-26T11:15:04.157\",\"lastModified\":\"2025-11-03T22:18:17.730\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nmemcg: protect concurrent access to mem_cgroup_idr\\n\\nCommit 73f576c04b94 (\\\"mm: memcontrol: fix cgroup creation failure after\\nmany small jobs\\\") decoupled the memcg IDs from the CSS ID space to fix the\\ncgroup creation failures.  It introduced IDR to maintain the memcg ID\\nspace.  The IDR depends on external synchronization mechanisms for\\nmodifications.  For the mem_cgroup_idr, the idr_alloc() and idr_replace()\\nhappen within css callback and thus are protected through cgroup_mutex\\nfrom concurrent modifications.  However idr_remove() for mem_cgroup_idr\\nwas not protected against concurrency and can be run concurrently for\\ndifferent memcgs when they hit their refcnt to zero.  Fix that.\\n\\nWe have been seeing list_lru based kernel crashes at a low frequency in\\nour fleet for a long time.  These crashes were in different part of\\nlist_lru code including list_lru_add(), list_lru_del() and reparenting\\ncode.  Upon further inspection, it looked like for a given object (dentry\\nand inode), the super_block\u0027s list_lru didn\u0027t have list_lru_one for the\\nmemcg of that object.  The initial suspicions were either the object is\\nnot allocated through kmem_cache_alloc_lru() or somehow\\nmemcg_list_lru_alloc() failed to allocate list_lru_one() for a memcg but\\nreturned success.  No evidence were found for these cases.\\n\\nLooking more deeply, we started seeing situations where valid memcg\u0027s id\\nis not present in mem_cgroup_idr and in some cases multiple valid memcgs\\nhave same id and mem_cgroup_idr is pointing to one of them.  So, the most\\nreasonable explanation is that these situations can happen due to race\\nbetween multiple idr_remove() calls or race between\\nidr_alloc()/idr_replace() and idr_remove().  These races are causing\\nmultiple memcgs to acquire the same ID and then offlining of one of them\\nwould cleanup list_lrus on the system for all of them.  Later access from\\nother memcgs to the list_lru cause crashes due to missing list_lru_one.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: memcg: protege el acceso simult\u00e1neo a mem_cgroup_idr. el commit 73f576c04b94 (\\\"mm: memcontrol: repara el error de creaci\u00f3n de cgroup despu\u00e9s de muchos trabajos peque\u00f1os\\\") desacopla los ID de memcg del espacio de ID de CSS para reparar el cgroup. fracasos de la creaci\u00f3n. Introdujo IDR para mantener el espacio de identificaci\u00f3n de memcg. El IDR depende de mecanismos externos de sincronizaci\u00f3n para las modificaciones. Para mem_cgroup_idr, idr_alloc() e idr_replace() ocurren dentro de la devoluci\u00f3n de llamada CSS y, por lo tanto, est\u00e1n protegidos a trav\u00e9s de cgroup_mutex contra modificaciones simult\u00e1neas. Sin embargo, idr_remove() para mem_cgroup_idr no estaba protegido contra la concurrencia y se puede ejecutar simult\u00e1neamente para diferentes memcgs cuando alcanzan su referencia a cero. Arregla eso. Hemos estado viendo fallas del kernel basadas en list_lru con baja frecuencia en nuestra flota durante mucho tiempo. Estos fallos se produjeron en diferentes partes del c\u00f3digo list_lru, incluidos list_lru_add(), list_lru_del() y el c\u00f3digo de reparaci\u00f3n. Tras una inspecci\u00f3n m\u00e1s detallada, parec\u00eda que para un objeto determinado (dentry e inodo), el list_lru del super_block no ten\u00eda list_lru_one para el memcg de ese objeto. Las sospechas iniciales fueron que el objeto no estaba asignado a trav\u00e9s de kmem_cache_alloc_lru() o de alguna manera memcg_list_lru_alloc() no pudo asignar list_lru_one() para un memcg pero devolvi\u00f3 el \u00e9xito. No se encontraron pruebas de estos casos. Mirando m\u00e1s profundamente, comenzamos a ver situaciones en las que la identificaci\u00f3n de memcg v\u00e1lida no est\u00e1 presente en mem_cgroup_idr y, en algunos casos, varios memcg v\u00e1lidos tienen la misma identificaci\u00f3n y mem_cgroup_idr apunta a uno de ellos. Entonces, la explicaci\u00f3n m\u00e1s razonable es que estas situaciones pueden ocurrir debido a la ejecuci\u00f3n entre m\u00faltiples llamadas idr_remove() o la ejecuci\u00f3n entre idr_alloc()/idr_replace() e idr_remove(). Estas ejecuciones est\u00e1n provocando que varios memcgs adquieran el mismo ID y luego desconectar uno de ellos limpiar\u00eda list_lrus en el sistema para todos ellos. El acceso posterior desde otros memcgs a list_lru provoca bloqueos debido a que falta list_lru_one.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":4.7,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.0,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.7\",\"versionEndExcluding\":\"6.6.46\",\"matchCriteriaId\":\"ACA5323A-A089-48EF-85AA-99E8DF835386\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.10.5\",\"matchCriteriaId\":\"D074AE50-4A5E-499C-A2FD-75FD60DEA560\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.11:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"8B3CE743-2126-47A3-8B7C-822B502CF119\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.11:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"4DEB27E7-30AA-45CC-8934-B89263EF3551\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/37a060b64ae83b76600d187d76591ce488ab836b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/51c0b1bb7541f8893ec1accba59eb04361a70946\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/56fd70f4aa8b82199dbe7e99366b1fd7a04d86fb\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/912736a0435ef40e6a4ae78197ccb5553cb80b05\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/9972605a238339b85bd16b084eed5f18414d22db\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e6cc9ff2ac0b5df9f25eb790934c3104f6710278\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://lists.debian.org/debian-lts-announce/2024/10/msg00003.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html\"}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2024/10/msg00003.html\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-11-03T22:06:51.189Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-43892\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-10T15:29:18.942187Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-11T12:42:12.492Z\"}}], \"cna\": {\"title\": \"memcg: protect concurrent access to mem_cgroup_idr\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"73f576c04b9410ed19660f74f97521bee6e1c546\", \"lessThan\": \"912736a0435ef40e6a4ae78197ccb5553cb80b05\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"73f576c04b9410ed19660f74f97521bee6e1c546\", \"lessThan\": \"e6cc9ff2ac0b5df9f25eb790934c3104f6710278\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"73f576c04b9410ed19660f74f97521bee6e1c546\", \"lessThan\": \"56fd70f4aa8b82199dbe7e99366b1fd7a04d86fb\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"73f576c04b9410ed19660f74f97521bee6e1c546\", \"lessThan\": \"37a060b64ae83b76600d187d76591ce488ab836b\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"73f576c04b9410ed19660f74f97521bee6e1c546\", \"lessThan\": \"51c0b1bb7541f8893ec1accba59eb04361a70946\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"73f576c04b9410ed19660f74f97521bee6e1c546\", \"lessThan\": \"9972605a238339b85bd16b084eed5f18414d22db\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"8627c7750a66a46d56d3564e1e881aa53764497c\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"db70cd18d3da727a3a59694de428a9e41c620de7\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"4.4.18\", \"lessThan\": \"4.5\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"4.6.6\", \"lessThan\": \"4.7\", \"versionType\": \"semver\"}], \"programFiles\": [\"mm/memcontrol.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.7\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"4.7\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.10.226\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.167\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.110\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.46\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.10.5\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.10.*\"}, {\"status\": \"unaffected\", \"version\": \"6.11\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"mm/memcontrol.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/912736a0435ef40e6a4ae78197ccb5553cb80b05\"}, {\"url\": \"https://git.kernel.org/stable/c/e6cc9ff2ac0b5df9f25eb790934c3104f6710278\"}, {\"url\": \"https://git.kernel.org/stable/c/56fd70f4aa8b82199dbe7e99366b1fd7a04d86fb\"}, {\"url\": \"https://git.kernel.org/stable/c/37a060b64ae83b76600d187d76591ce488ab836b\"}, {\"url\": \"https://git.kernel.org/stable/c/51c0b1bb7541f8893ec1accba59eb04361a70946\"}, {\"url\": \"https://git.kernel.org/stable/c/9972605a238339b85bd16b084eed5f18414d22db\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nmemcg: protect concurrent access to mem_cgroup_idr\\n\\nCommit 73f576c04b94 (\\\"mm: memcontrol: fix cgroup creation failure after\\nmany small jobs\\\") decoupled the memcg IDs from the CSS ID space to fix the\\ncgroup creation failures.  It introduced IDR to maintain the memcg ID\\nspace.  The IDR depends on external synchronization mechanisms for\\nmodifications.  For the mem_cgroup_idr, the idr_alloc() and idr_replace()\\nhappen within css callback and thus are protected through cgroup_mutex\\nfrom concurrent modifications.  However idr_remove() for mem_cgroup_idr\\nwas not protected against concurrency and can be run concurrently for\\ndifferent memcgs when they hit their refcnt to zero.  Fix that.\\n\\nWe have been seeing list_lru based kernel crashes at a low frequency in\\nour fleet for a long time.  These crashes were in different part of\\nlist_lru code including list_lru_add(), list_lru_del() and reparenting\\ncode.  Upon further inspection, it looked like for a given object (dentry\\nand inode), the super_block\u0027s list_lru didn\u0027t have list_lru_one for the\\nmemcg of that object.  The initial suspicions were either the object is\\nnot allocated through kmem_cache_alloc_lru() or somehow\\nmemcg_list_lru_alloc() failed to allocate list_lru_one() for a memcg but\\nreturned success.  No evidence were found for these cases.\\n\\nLooking more deeply, we started seeing situations where valid memcg\u0027s id\\nis not present in mem_cgroup_idr and in some cases multiple valid memcgs\\nhave same id and mem_cgroup_idr is pointing to one of them.  So, the most\\nreasonable explanation is that these situations can happen due to race\\nbetween multiple idr_remove() calls or race between\\nidr_alloc()/idr_replace() and idr_remove().  These races are causing\\nmultiple memcgs to acquire the same ID and then offlining of one of them\\nwould cleanup list_lrus on the system for all of them.  Later access from\\nother memcgs to the list_lru cause crashes due to missing list_lru_one.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.226\", \"versionStartIncluding\": \"4.7\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.167\", \"versionStartIncluding\": \"4.7\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.110\", \"versionStartIncluding\": \"4.7\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.46\", \"versionStartIncluding\": \"4.7\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.10.5\", \"versionStartIncluding\": \"4.7\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.11\", \"versionStartIncluding\": \"4.7\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"4.4.18\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"4.6.6\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-05-23T15:53:10.333Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-43892\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-05-23T15:53:10.333Z\", \"dateReserved\": \"2024-08-17T09:11:59.290Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-08-26T10:10:46.612Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.