CVE-2024-46678

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

bonding: change ipsec_lock from spin lock to mutex

In the cited commit, bond->ipsec_lock is added to protect ipsec_list,

hence xdo_dev_state_add and xdo_dev_state_delete are called inside

this lock. As ipsec_lock is a spin lock and such xfrmdev ops may sleep,

"scheduling while atomic" will be triggered when changing bond's

active slave.

[ 101.055189] BUG: scheduling while atomic: bash/902/0x00000200

[ 101.055726] Modules linked in:

[ 101.058211] CPU: 3 PID: 902 Comm: bash Not tainted 6.9.0-rc4+ #1

[ 101.058760] Hardware name:

[ 101.059434] Call Trace:

[ 101.059436] <TASK>

[ 101.060873] dump_stack_lvl+0x51/0x60

[ 101.061275] __schedule_bug+0x4e/0x60

[ 101.061682] __schedule+0x612/0x7c0

[ 101.062078] ? __mod_timer+0x25c/0x370

[ 101.062486] schedule+0x25/0xd0

[ 101.062845] schedule_timeout+0x77/0xf0

[ 101.063265] ? asm_common_interrupt+0x22/0x40

[ 101.063724] ? __bpf_trace_itimer_state+0x10/0x10

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References