Read the docs
TI-2024-33721 Aliases CVE-2024-50280GHSA-r79x-wgrg-2v77

dm cache: fix flushing uninitialized delayed_work on cache_ctr error

Priority LOW 36CWE-416Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 4 without a fix

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and Red Hat. Impact type from CWE-416 and the CVSS impact.

Summary

In the Linux kernel, the following vulnerability has been resolved: dm cache: fix flushing uninitialized delayed_work on cache_ctr error An unexpected WARN_ON from flush_work() may occur when cache creation fails, caused by destroying the uninitialized delayed_work waker in the error path of cache_create(). For example, the warning appears on the superblock checksum error. Reproduce steps: dmsetup create cmeta --table "0 8192 linear /dev/sdc 0" dmsetup create cdata --table "0 65536 linear /dev/sdc 8192" dmsetup create corig --table "0 524288 linear /dev/sdc 262144" dd if=/dev/urandom of=/dev/mapper/cmeta bs=4k count=1 oflag=direct dmsetup create cache --table "0 524288 cache /dev/mapper/cmeta \ /dev/mapper/cdata /dev/mapper/corig 128 2 metadata2 writethrough smq 0" Kernel logs: (snip) WARNING: CPU: 0 PID: 84 at kernel/workqueue.c:4178 __flush_work+0x5d4/0x890 Fix by pulling out the cancel_delayed_work_sync() from the constructor's error path. This patch doesn't affect the use-after-free fix for concurrent dm_resume and dm_destroy (commit 6a459d8edbdb ("dm cache: Fix UAF in destroy()")) as cache_dtr is not changed.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00251 16th percentileScored 2026-11-07
Fix Partial Linux (Linux): 5.10.237, 5.15.181, 6.1.117 +8Red Hat: 4 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
LinuxLinux5.10.163 to before 5.10.237; 5.15.87 to before 5.15.181; 6.1.4 to before 6.1.117; 4.9.337 to before 4.10; 4.14.303 to before 4.15; 4.19.270 to before 4.20; 5.4.229 to before 5.5; 6.0.18 to before 6.15.10.237, 5.15.181, 6.1.117, 4.10, 4.15, 4.20, 5.5, 6.1Patch availableCNA
LinuxLinux6.2 and later5.10.237, 5.15.181, 6.1.117, 6.6.61, 6.11.8, 6.12Patch availableCNA
  • Linux VendorLinux Affected 5.10.163 to before 5.10.237; 5.15.87 to before 5.15.181; 6.1.4 to before 6.1.117; 4.9.337 to before 4.10; 4.14.303 to before 4.15; 4.19.270 to before 4.20; 5.4.229 to before 5.5; 6.0.18 to before 6.1 Fixed in 5.10.237, 5.15.181, 6.1.117, 4.10, 4.15, 4.20, 5.5, 6.1 Patch available CNA
  • Linux VendorLinux Affected 6.2 and later Fixed in 5.10.237, 5.15.181, 6.1.117, 6.6.61, 6.11.8, 6.12 Patch available CNA

CPE configurations NVD · 7

CPEVersionsRoleVendor
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*4.9.337 to before 4.10; 4.14.303 to before 4.15; 4.19.270 to before 4.20; 5.4.229 to before 5.5; 5.10.163 to before 5.11; 5.15.87 to before 5.16; 6.0.18 to before 6.1; 6.1.4 to before 6.1.117; 6.2 to before 6.6.61; 6.7 to before 6.11.8VulnerableLinux
cpe:2.3:o:linux:linux_kernel:6.12:rc1:*:*:*:*:*:*6.12 rc1VulnerableLinux
cpe:2.3:o:linux:linux_kernel:6.12:rc2:*:*:*:*:*:*6.12 rc2VulnerableLinux
cpe:2.3:o:linux:linux_kernel:6.12:rc3:*:*:*:*:*:*6.12 rc3VulnerableLinux
cpe:2.3:o:linux:linux_kernel:6.12:rc4:*:*:*:*:*:*6.12 rc4VulnerableLinux
cpe:2.3:o:linux:linux_kernel:6.12:rc5:*:*:*:*:*:*6.12 rc5VulnerableLinux
cpe:2.3:o:linux:linux_kernel:6.12:rc6:*:*:*:*:*:*6.12 rc6VulnerableLinux
  • cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* Versions 4.9.337 to before 4.10; 4.14.303 to before 4.15; 4.19.270 to before 4.20; 5.4.229 to before 5.5; 5.10.163 to before 5.11; 5.15.87 to before 5.16; 6.0.18 to before 6.1; 6.1.4 to before 6.1.117; 6.2 to before 6.6.61; 6.7 to before 6.11.8 Vulnerable ·Linux
  • cpe:2.3:o:linux:linux_kernel:6.12:rc1:*:*:*:*:*:* Versions 6.12 rc1 Vulnerable ·Linux
  • cpe:2.3:o:linux:linux_kernel:6.12:rc2:*:*:*:*:*:* Versions 6.12 rc2 Vulnerable ·Linux
  • cpe:2.3:o:linux:linux_kernel:6.12:rc3:*:*:*:*:*:* Versions 6.12 rc3 Vulnerable ·Linux
  • cpe:2.3:o:linux:linux_kernel:6.12:rc4:*:*:*:*:*:* Versions 6.12 rc4 Vulnerable ·Linux
  • cpe:2.3:o:linux:linux_kernel:6.12:rc5:*:*:*:*:*:* Versions 6.12 rc5 Vulnerable ·Linux
  • cpe:2.3:o:linux:linux_kernel:6.12:rc6:*:*:*:*:*:* Versions 6.12 rc6 Vulnerable ·Linux

Remediation

  • Fix · CNA Linux (Linux) Fixed in 5.10.237, 5.15.181, 6.1.117, 4.10, 4.15, 4.20, 5.5, 6.1
  • Fix · CNA Linux (Linux) Fixed in 5.10.237, 5.15.181, 6.1.117, 6.6.61, 6.11.8, 6.12

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 6AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 7AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 8AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 9AffectedNo fix yet: Fix deferred

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-50280
  2. 2026-10-03 Alias added: GHSA-r79x-wgrg-2v77

References

Patch 4

Other 2

  • TI-2025-26358 tls: fix handling of zero-length records on the rx_list KEVCVSS 3.1CRITICAL 9.8
  • TI-2026-38352 netfilter: bridge: make ebt_snat ARP rewrite writable KEVCVSS 3.1HIGH 8.8
  • TI-2013-05264 The (1) get_user and (2) put_user API functions in the Linux kernel before 3.5.5 on the… KEVCVSS 3.1HIGH 8.8
  • TI-2022-00125 Integer overflow in kernel KEVCVSS 3.1HIGH 8.4
  • TI-2013-01864 The perf_swevent_init function in kernel/events/core.c in the Linux kernel before 3.8.9… KEVCVSS 3.1HIGH 8.4
  • TI-2021-05514 Heap Out-Of-Bounds Write in Netfilter IP6T_SO_SET_REPLACE KEVCVSS 3.1HIGH 8.3
See all 15278 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences