{"id":"CVE-2024-56584","title":"io_uring/tctx: work around xa_store() allocation error issue","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/tctx: work around xa_store() allocation error issue\n\nsyzbot triggered the following WARN_ON:\n\nWARNING: CPU: 0 PID: 16 at io_uring/tctx.c:51 __io_uring_free+0xf…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 2b188cc1bb857a9d4701ae59aa7768b5124e262e < e05c070b401f6365c503e2b59f091331965c4fb9","Linux >= 2b188cc1bb857a9d4701ae59aa7768b5124e262e < 3a84fa784710990964c1e35df743851ab2863898","Linux >= 2b188cc1bb857a9d4701ae59aa7768b5124e262e < 94ad56f61b873ffeebcc620d451eacfbdf9d40f0","Linux >= 2b188cc1bb857a9d4701ae59aa7768b5124e262e < 42882b583095dcf747da6e3af1daeff40e27033e","Linux >= 2b188cc1bb857a9d4701ae59aa7768b5124e262e < d5b2ddf1f90c7248eff9630b95895c8950f2f36d","Linux >= 2b188cc1bb857a9d4701ae59aa7768b5124e262e < 7eb75ce7527129d7f1fee6951566af409a37a1c4","Linux 5.1"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-05T20:28:57.530482Z"},"published":"2024-12-27","updated":"2026-11-05","sourceUpdated":"2026-11-05T20:31:24.360Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2024-56584","references":[{"url":"https://git.kernel.org/stable/c/e05c070b401f6365c503e2b59f091331965c4fb9"},{"url":"https://git.kernel.org/stable/c/3a84fa784710990964c1e35df743851ab2863898"},{"url":"https://git.kernel.org/stable/c/94ad56f61b873ffeebcc620d451eacfbdf9d40f0"},{"url":"https://git.kernel.org/stable/c/42882b583095dcf747da6e3af1daeff40e27033e"},{"url":"https://git.kernel.org/stable/c/d5b2ddf1f90c7248eff9630b95895c8950f2f36d"},{"url":"https://git.kernel.org/stable/c/7eb75ce7527129d7f1fee6951566af409a37a1c4"}],"tags":["cve.org"],"epss":0.00238,"epssPercentile":0.14879,"ingestedAt":"2026-11-05T22:38:31.833Z","slug":"CVE-2024-56584","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/tctx: work around xa_store() allocation error issue\n\nsyzbot triggered the following WARN_ON:\n\nWARNING: CPU: 0 PID: 16 at io_uring/tctx.c:51 __io_uring_free+0xfa/0x140 io_uring/tctx.c:51\n\nwhich is the\n\nWARN_ON_ONCE(!xa_empty(&tctx->xa));\n\nsanity check in __io_uring_free() when a io_uring_task is going through\nits final put. The syzbot test case includes injecting memory allocation\nfailures, and it very much looks like xa_store() can fail one of its\nmemory allocations and end up with ->head being non-NULL even though no\nentries exist in the xarray.\n\nUntil this issue gets sorted out, work around it by attempting to\niterate entries in our xarray, and WARN_ON_ONCE() if one is found.\n\n## Affected\n\n- `Linux >= 2b188cc1bb857a9d4701ae59aa7768b5124e262e < e05c070b401f6365c503e2b59f091331965c4fb9`\n- `Linux >= 2b188cc1bb857a9d4701ae59aa7768b5124e262e < 3a84fa784710990964c1e35df743851ab2863898`\n- `Linux >= 2b188cc1bb857a9d4701ae59aa7768b5124e262e < 94ad56f61b873ffeebcc620d451eacfbdf9d40f0`\n- `Linux >= 2b188cc1bb857a9d4701ae59aa7768b5124e262e < 42882b583095dcf747da6e3af1daeff40e27033e`\n- `Linux >= 2b188cc1bb857a9d4701ae59aa7768b5124e262e < d5b2ddf1f90c7248eff9630b95895c8950f2f36d`\n- `Linux >= 2b188cc1bb857a9d4701ae59aa7768b5124e262e < 7eb75ce7527129d7f1fee6951566af409a37a1c4`\n- `Linux 5.1`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}