CVE-2024-26764

LowCVSS 3.3/10Last modified Jun 17, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

fs/aio: Restrict kiocb_set_cancel_fn() to I/O submitted via libaio

If kiocb_set_cancel_fn() is called for I/O submitted via io_uring, the following kernel warning appears:

WARNING: CPU: 3 PID: 368 at fs/aio.c:598 kiocb_set_cancel_fn+0x9c/0xa8 Call trace: kiocb_set_cancel_fn+0x9c/0xa8 ffs_epfile_read_iter+0x144/0x1d0 io_read+0x19c/0x498 io_issue_sqe+0x118/0x27c io_submit_sqes+0x25c/0x5fc __arm64_sys_io_uring_enter+0x104/0xab0 invoke_syscall+0x58/0x11c el0_svc_common+0xb4/0xf4 do_el0_svc+0x2c/0xb0 el0_svc+0x2c/0xa4 el0t_64_sync_handler+0x68/0xb4 el0t_64_sync+0x1a4/0x1a8

Fix this by setting the IOCB_AIO_RW flag for read and write I/O that is submitted by libaio.

Metrics

CVSS 3.1 3.3/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Affected software

VendorProductVersions
LinuxLinux>= 04b2fa9f8f36ec6fb6fd1c9dc9df6fff0cd27323, < 337b543e274fe7a8f47df3c8293cc6686ffa620f; >= 04b2fa9f8f36ec6fb6fd1c9dc9df6fff0cd27323, < b4eea7a05ee0ab5ab0514421e6ba8c5d249cf942; >= 04b2fa9f8f36ec6fb6fd1c9dc9df6fff0cd27323, < ea1cd64d59f22d6d13f367d62ec6e27b9344695f; >= 04b2fa9f8f36ec6fb6fd1c9dc9df6fff0cd27323, < d7b6fa97ec894edd02f64b83e5e72e1aa352f353; >= 04b2fa9f8f36ec6fb6fd1c9dc9df6fff0cd27323, < 18f614369def2a11a52f569fe0f910b199d13487; >= 04b2fa9f8f36ec6fb6fd1c9dc9df6fff0cd27323, < e7e23fc5d5fe422827c9a43ecb579448f73876c7; >= 04b2fa9f8f36ec6fb6fd1c9dc9df6fff0cd27323, < 1dc7d74fe456944a9b1c57bd776280249f441ac6; >= 04b2fa9f8f36ec6fb6fd1c9dc9df6fff0cd27323, < b820de741ae48ccf50dd95e297889c286ff4f760
LinuxLinux4.1

References

Timeline

Published
Apr 3, 2024
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-267655.5In the Linux kernel, the following vulnerability has been resolved: LoongArch: Disable IRQ before init_fn() for nonboot CPUs Disable IRQ bCVE-2024-267665.5In the Linux kernel, the following vulnerability has been resolved: IB/hfi1: Fix sdma.h tx->num_descs off-by-one error Unfortunately the cCVE-2024-267675.5In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: fixed integer types and null check locations [why]: iCVE-2024-267687.2In the Linux kernel, the following vulnerability has been resolved: LoongArch: Change acpi_core_pic[NR_CPUS] to acpi_core_pic[MAX_CORE_PIC]CVE-2024-267697.5In the Linux kernel, the following vulnerability has been resolved: nvmet-fc: avoid deadlock on delete association path When deleting an aCVE-2024-26776.5A vulnerability has been found in Campcodes Online Job Finder System 1.0 and classified as critical. Affected by this vulnerability is an unCVE-2024-267705.5In the Linux kernel, the following vulnerability has been resolved: HID: nvidia-shield: Add missing null pointer checks to LED initializatiCVE-2024-267715.5In the Linux kernel, the following vulnerability has been resolved: dmaengine: ti: edma: Add some null pointer checks to the edma_probe deCVE-2024-267727.8In the Linux kernel, the following vulnerability has been resolved: ext4: avoid allocating blocks from corrupted group in ext4_mb_find_by_gCVE-2024-267735.5In the Linux kernel, the following vulnerability has been resolved: ext4: avoid allocating blocks from corrupted group in ext4_mb_try_best_CVE-2024-267745.5In the Linux kernel, the following vulnerability has been resolved: ext4: avoid dividing by 0 in mb_update_avg_fragment_size() when block bCVE-2024-267755.5In the Linux kernel, the following vulnerability has been resolved: aoe: avoid potential deadlock at set_capacity Move set_capacity() outs
CVE-2024-26764: Low severity, CVSS 3.3 | Vulnix