{"id":"CVE-2024-53090","title":"afs: Fix lock recursion","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nafs: Fix lock recursion\n\nafs_wake_up_async_call() can incur lock recursion.  The problem is that it\nis called from AF_RXRPC whilst holding the ->notify_lock, but it tri…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvssSource":"cna","vendor":"Linux","product":"Linux","affected":["Linux >= 20acbd9a7aeee0b0af7107f3de791a52c949f3ac < d256a7f2385cf59d09526c794367d44fd7a26c7a","Linux >= 20acbd9a7aeee0b0af7107f3de791a52c949f3ac < 9ada9ff6339d49df2260bb876ccf895d88928f81","Linux >= 20acbd9a7aeee0b0af7107f3de791a52c949f3ac < d7cbf81df996b1eae2dee8deb6df08e2eba78661","Linux >= 20acbd9a7aeee0b0af7107f3de791a52c949f3ac < 610a79ffea02102899a1373fe226d949944a7ed6","Linux 4.15"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2025-10-01T20:11:33.834587Z"},"published":"2024-11-21","updated":"2026-10-30","sourceUpdated":"2026-10-30T12:19:58.981Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2024-53090","references":[{"url":"https://git.kernel.org/stable/c/d256a7f2385cf59d09526c794367d44fd7a26c7a"},{"url":"https://git.kernel.org/stable/c/9ada9ff6339d49df2260bb876ccf895d88928f81"},{"url":"https://git.kernel.org/stable/c/d7cbf81df996b1eae2dee8deb6df08e2eba78661"},{"url":"https://git.kernel.org/stable/c/610a79ffea02102899a1373fe226d949944a7ed6"}],"tags":["cve.org"],"epss":0.00675,"epssPercentile":0.52166,"ingestedAt":"2026-10-21T12:48:53.728Z","slug":"CVE-2024-53090","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nafs: Fix lock recursion\n\nafs_wake_up_async_call() can incur lock recursion.  The problem is that it\nis called from AF_RXRPC whilst holding the ->notify_lock, but it tries to\ntake a ref on the afs_call struct in order to pass it to a work queue - but\nif the afs_call is already queued, we then have an extraneous ref that must\nbe put... calling afs_put_call() may call back down into AF_RXRPC through\nrxrpc_kernel_shutdown_call(), however, which might try taking the\n->notify_lock again.\n\nThis case isn't very common, however, so defer it to a workqueue.  The oops\nlooks something like:\n\n  BUG: spinlock recursion on CPU#0, krxrpcio/7001/1646\n   lock: 0xffff888141399b30, .magic: dead4ead, .owner: krxrpcio/7001/1646, .owner_cpu: 0\n  CPU: 0 UID: 0 PID: 1646 Comm: krxrpcio/7001 Not tainted 6.12.0-rc2-build3+ #4351\n  Hardware name: ASUS All Series/H97-PLUS, BIOS 2306 10/09/2014\n  Call Trace:\n   <TASK>\n   dump_stack_lvl+0x47/0x70\n   do_raw_spin_lock+0x3c/0x90\n   rxrpc_kernel_shutdown_call+0x83/0xb0\n   afs_put_call+0xd7/0x180\n   rxrpc_notify_socket+0xa0/0x190\n   rxrpc_input_split_jumbo+0x198/0x1d0\n   rxrpc_input_data+0x14b/0x1e0\n   ? rxrpc_input_call_packet+0xc2/0x1f0\n   rxrpc_input_call_event+0xad/0x6b0\n   rxrpc_input_packet_on_conn+0x1e1/0x210\n   rxrpc_input_packet+0x3f2/0x4d0\n   rxrpc_io_thread+0x243/0x410\n   ? __pfx_rxrpc_io_thread+0x10/0x10\n   kthread+0xcf/0xe0\n   ? __pfx_kthread+0x10/0x10\n   ret_from_fork+0x24/0x40\n   ? __pfx_kthread+0x10/0x10\n   ret_from_fork_asm+0x1a/0x30\n   </TASK>\n\n## Affected\n\n- `Linux >= 20acbd9a7aeee0b0af7107f3de791a52c949f3ac < d256a7f2385cf59d09526c794367d44fd7a26c7a`\n- `Linux >= 20acbd9a7aeee0b0af7107f3de791a52c949f3ac < 9ada9ff6339d49df2260bb876ccf895d88928f81`\n- `Linux >= 20acbd9a7aeee0b0af7107f3de791a52c949f3ac < d7cbf81df996b1eae2dee8deb6df08e2eba78661`\n- `Linux >= 20acbd9a7aeee0b0af7107f3de791a52c949f3ac < 610a79ffea02102899a1373fe226d949944a7ed6`\n- `Linux 4.15`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}