CVE-2024-26758

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

md: Don't ignore suspended array in md_check_recovery()

mddev_suspend() never stop sync_thread, hence it doesn't make sense to

ignore suspended array in md_check_recovery(), which might cause

sync_thread can't be unregistered.

After commit f52f5c71f3d4 ("md: fix stopping sync thread"), following

hang can be triggered by test shell/integrity-caching.sh:

1) suspend the array:

raid_postsuspend

mddev_suspend

2) stop the array:

raid_dtr

md_stop

__md_stop_writes

stop_sync_thread

set_bit(MD_RECOVERY_INTR, &mddev->recovery);

md_wakeup_thread_directly(mddev->sync_thread);

wait_event(..., !test_bit(MD_RECOVERY_RUNNING, &mddev->recovery))

3) sync thread done:

md_do_sync

set_bit(MD_RECOVERY_DONE, &mddev->recovery);

md_wakeup_thread(mddev->thread);

4) daemon thread can't unregister sync thread:

md_check_recovery

if (mddev->suspended)

return; -> return directly

md_read_sync_thread

clear_bit(MD_RECOV

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References