CVE-2024-50079: 
Linux Debian vulnerability analysis and mitigation

In the Linux kernel, a vulnerability (CVE-2024-50079) was discovered in the io_uring/sqpoll functionality. The issue occurs when the sqpoll is exiting and cancels pending work items, potentially needing to run task_work. If this happens within io_uring_cancel_generic(), it may be waiting for the io_uring_task waitqueue, resulting in the ring mutex being attempted to be grabbed while in a TASK_INTERRUPTIBLE state (NVD, Kernel Patch).

The vulnerability stems from a task state management issue where the system attempts to perform blocking operations while not in TASK_RUNNING state. This results in a scheduler warning when the task state is TASK_INTERRUPTIBLE. The issue affects Linux kernel versions from 6.9 up to (excluding) 6.11.5, and specific release candidates 6.12-rc1 through 6.12-rc3. The vulnerability has been assigned a CVSS v3.1 Base Score of 5.5 (Medium) with vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (NVD).

The vulnerability can lead to system instability and potential denial of service conditions when the task state is incorrectly managed during io_uring operations. This primarily affects system availability, with no direct impact on confidentiality or integrity (NVD).

The issue has been fixed by ensuring that the task state is set to TASK_RUNNING when running task_work, similar to other cases in io_run_task_work(). The fix involves adding a single line of code to set the current state to TASK_RUNNING before executing task work (Kernel Patch).