CVE-2024-38663

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.6.37

Description The issue is related to the blk-cgroup component in the Linux kernel, where list corruption can occur when resetting io stat. This happens because each iostat instance is added to the blkcg percpu list, and the blkcg reset stats() function cannot reset the stat instance using memset(), which may cause the llist to be corrupted. The problem is fixed by only resetting the counter part.

Recommendations To resolve the issue, update the Linux kernel to version 6.6.37 or later. As a temporary workaround, consider restricting access to the vulnerable blkcg reset stats() function until a patch is available.