nbd: fix race between timeout and normal completion

CVE-2024-49855

What is CVE-2024-49855?

A vulnerability exists in the Linux kernel related to the Network Block Device (NBD) functionality. This issue arises from a race condition occurring during command processing, where a request timeout could lead to an improper handling of the command state, potentially allowing for a use-after-free condition. The vulnerability is addressed by modifying the nbd_requeue_cmd() function to ensure that when a command is requeued due to a timeout, the command's in-flight status is cleared properly. This fix requires that the command lock is correctly acquired during this operation, effectively preventing further complications during the requeuing process and enhancing overall system stability.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References