CVE-2024-38598md: fix resync softlockup when bitmap size is less than array size
Updated under an hour ago ()
Does this affect you?
It affects Linux and 8 other products. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: md: fix resync softlockup when bitmap size is less than array size Is is reported that for dm-raid10, lvextend + lvchange --syncaction will trigger following softlockup: kernel:watchdog: BUG: soft lockup - CPU#3 stuck for 26s! [mdX_resync:6976] CPU: 7 PID: 3588 Comm: mdX_resync Kdump: loaded Not tainted 6.9.0-rc4-next-20240419 #1 RIP: 0010:_raw_spin_unlock_irq+0x13/0x30 Call Trace: <TASK> md_bitmap_start_sync+0x6b/0xf0 raid10_sync_request+0x25c/0x1b40 [raid10] md_do_sync+0x64b/0x1020 md_thread+0xa7/0x170 kthread+0xcf/0x100 ret_from_fork+0x30/0x50 ret_from_fork_asm+0x1a/0x30 And the detailed process is as follows: md_do_sync j = mddev->resync_min while (j < max_sectors) sectors = raid10_sync_request(mddev, j, &skipped) if (!md_bitmap_start_sync(..., &sync_blocks)) // md_bitmap_start_sync set sync_blocks to 0 return sync_blocks + sectors_skippe; // sectors = 0; j += sectors; // j never change Root cause is that commit 301867b1c168 ("md/raid10: check slab-out-of-bounds in md_bitmap_get_counter") return early from md_bitmap_get_counter(), without setting returned blocks. Fix this problem by always set returned blocks from md_bitmap_get_counter"(), as it used to be. Noted that this patch just fix the softlockup problem in kernel, the case that bitmap size doesn't match array size still need to be fixed.
- CVSS
- 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Modified
- Record last updated
- Oct 15, 2026
- First seen by InfoSec Signals
- Oct 15, 2026
Affected products
Linux Linux linux:linux (from the name) | from 374fb914304d9b500721007f3837ea8f1f9a2418 before d4b9c764d48fa41caa24cfb4275f3aa9fb4bd798; from b0b971fe7d61411ede63c3291764dbde1577ef2c before 43771597feba89a839c5f893716df88ae5c237ce; 39fa14e824acfd470db4f42c354297456bd82b53 builds before 3f5b73ef8fd6268cbc968b308d8eafe56fda97f3; from a134dd582c0d5b6068efa308bd485cf1d00b3f65 before 69296914bfd508c85935bf5f711cad9b0fe78492; from be1a3ec63a840cc9e59a033acf154f56255699a1 before 71e8e4f288e74a896b6d9cd194f3bab12bd7a10f; from 301867b1c16805aebbc306aafa6ecdc68b73c7e5 before c9566b812c8f66160466cc1e29df6d3646add0b1; 301867b1c16805aebbc306aafa6ecdc68b73c7e5 builds before 5817f43ae1a118855676f57ef7ab50e37eac7482; 301867b1c16805aebbc306aafa6ecdc68b73c7e5 builds before 8bbc71315e0ae4bb7e37f8d43b915e1cb01a481b; and 10 more ranges | CNA record |
Siemens RUGGEDCOM RST2428P siemens:ruggedcom_rst2428p (from the name) | before V3.1 | CISA ADP |
Siemens SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family siemens:scalance_xc_300_xr_300_xc_400_xr_500wg_xr_500_family (from the name) | all versions not affected | CISA ADP |
Siemens SCALANCE XCM-/XRM-/XCH-/XRH-300 family siemens:scalance_xcm_xrm_xch_xrh_300_family (from the name) | before V3.1 | CISA ADP |
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518_4_pn_dp_mfp (from the name) | from V3.1.0 before V3.1.5 | CISA ADP |
Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518f_4_pn_dp_mfp (from the name) | from V3.1.0 before V3.1.5 | CISA ADP |
Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem siemens:simatic_s7_1500_tm_mfp_gnu_linux_subsystem (from the name) | before V1.1.1 | CISA ADP |
Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP siemens:siplus_s7_1500_cpu_1518_4_pn_dp_mfp (from the name) | from V3.1.0 before V3.1.5 | CISA ADP |
linux linux_kernel linux:linux_kernel | from 4.19.291 before 4.19.316; from 5.4.251 before 5.4.278; from 5.10.188 before 5.10.219; from 5.15.121 before 5.15.161; from 6.1.39 before 6.1.93; from 6.5 before 6.6.33; from 6.7 before 6.8.12; from 6.9 before 6.9.3 | NVD |
References
- https://git.kernel.org/stable/c/d4b9c764d48fa41caa24cfb4275f3aa9fb4bd798patch
- https://git.kernel.org/stable/c/43771597feba89a839c5f893716df88ae5c237cepatch
- https://git.kernel.org/stable/c/3f5b73ef8fd6268cbc968b308d8eafe56fda97f3patch
- https://git.kernel.org/stable/c/69296914bfd508c85935bf5f711cad9b0fe78492patch
- https://git.kernel.org/stable/c/71e8e4f288e74a896b6d9cd194f3bab12bd7a10fpatch
- https://git.kernel.org/stable/c/c9566b812c8f66160466cc1e29df6d3646add0b1patch
- https://git.kernel.org/stable/c/5817f43ae1a118855676f57ef7ab50e37eac7482patch
- https://git.kernel.org/stable/c/8bbc71315e0ae4bb7e37f8d43b915e1cb01a481bpatch
- https://git.kernel.org/stable/c/f0e729af2eb6bee9eb58c4df1087f14ebaefe26bpatch
- https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html
- https://cert-portal.siemens.com/productcert/html/ssa-265688.html
- https://cert-portal.siemens.com/productcert/html/ssa-398330.html
- https://cert-portal.siemens.com/productcert/html/ssa-613116.html
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.