---
id: CVE-2024-27005
title: 'interconnect: Don''t access req_list while it''s being manipulated'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  interconnect: Don't access req_list while it's being manipulated

  The icc_lock mutex was split into separate icc_lock and icc_bw_lock
  mutexes in [1] to avoid lockdep sp…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 9be2957f014d91088db1eb5dd09d9a03d7184dce <
    fe549d8e976300d0dd75bd904eb216bed8b145e0
  - >-
    Linux >= ee42bfc791aa3cd78e29046f26a09d189beb3efb <
    19ec82b3cad1abef2a929262b8c1528f4e0c192d
  - >-
    Linux >= ffb8917c70a4c88725ee40f9eeee9240ad1c1869 <
    8401bc2c188030fb14d1cb43c402a1cf42d86dd2
  - >-
    Linux >= af42269c3523492d71ebbe11fefae2653e9cdc78 <
    d0d04efa2e367921654b5106cc5c05e3757c2b42
  - >-
    Linux >= af42269c3523492d71ebbe11fefae2653e9cdc78 <
    4c65507121ea8e0b47fae6d2049c8688390d46b6
  - >-
    Linux >= af42269c3523492d71ebbe11fefae2653e9cdc78 <
    de1bf25b6d771abdb52d43546cf57ad775fb68a1
  - Linux 2f3a124696d43de3c837f87a9f767c56ee86cf2a
  - Linux >= 5.15.133 < 5.15.151
  - Linux >= 6.1.55 < 6.1.81
  - Linux >= 6.5.5 < 6.6
  - Linux 6.6
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2024-06-06T18:46:13.449387Z'
published: '2024-05-01'
updated: '2026-10-30'
sourceUpdated: '2026-10-30T12:18:05.338Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2024-27005'
references:
  - url: 'https://git.kernel.org/stable/c/fe549d8e976300d0dd75bd904eb216bed8b145e0'
  - url: 'https://git.kernel.org/stable/c/19ec82b3cad1abef2a929262b8c1528f4e0c192d'
  - url: 'https://git.kernel.org/stable/c/8401bc2c188030fb14d1cb43c402a1cf42d86dd2'
  - url: 'https://git.kernel.org/stable/c/d0d04efa2e367921654b5106cc5c05e3757c2b42'
  - url: 'https://git.kernel.org/stable/c/4c65507121ea8e0b47fae6d2049c8688390d46b6'
  - url: 'https://git.kernel.org/stable/c/de1bf25b6d771abdb52d43546cf57ad775fb68a1'
tags:
  - cve.org
epss: 0.00189
epssPercentile: 0.08552
ingestedAt: '2026-11-03T12:44:28.803Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

interconnect: Don't access req_list while it's being manipulated

The icc_lock mutex was split into separate icc_lock and icc_bw_lock
mutexes in [1] to avoid lockdep splats. However, this didn't adequately
protect access to icc_node::req_list.

The icc_set_bw() function will eventually iterate over req_list while
only holding icc_bw_lock, but req_list can be modified while only
holding icc_lock. This causes races between icc_set_bw(), of_icc_get(),
and icc_put().

Example A:

  CPU0                               CPU1
  ----                               ----
  icc_set_bw(path_a)
    mutex_lock(&icc_bw_lock);
                                     icc_put(path_b)
                                       mutex_lock(&icc_lock);
    aggregate_requests()
      hlist_for_each_entry(r, ...
                                       hlist_del(...
        <r = invalid pointer>

Example B:

  CPU0                               CPU1
  ----                               ----
  icc_set_bw(path_a)
    mutex_lock(&icc_bw_lock);
                                     path_b = of_icc_get()
                                       of_icc_get_by_index()
                                         mutex_lock(&icc_lock);
                                         path_find()
                                           path_init()
    aggregate_requests()
      hlist_for_each_entry(r, ...
                                             hlist_add_head(...
        <r = invalid pointer>

Fix this by ensuring icc_bw_lock is always held before manipulating
icc_node::req_list. The additional places icc_bw_lock is held don't
perform any memory allocations, so we should still be safe from the
original lockdep splats that motivated the separate locks.

[1] commit af42269c3523 ("interconnect: Fix locking for runpm vs reclaim")

## Affected

- `Linux >= 9be2957f014d91088db1eb5dd09d9a03d7184dce < fe549d8e976300d0dd75bd904eb216bed8b145e0`
- `Linux >= ee42bfc791aa3cd78e29046f26a09d189beb3efb < 19ec82b3cad1abef2a929262b8c1528f4e0c192d`
- `Linux >= ffb8917c70a4c88725ee40f9eeee9240ad1c1869 < 8401bc2c188030fb14d1cb43c402a1cf42d86dd2`
- `Linux >= af42269c3523492d71ebbe11fefae2653e9cdc78 < d0d04efa2e367921654b5106cc5c05e3757c2b42`
- `Linux >= af42269c3523492d71ebbe11fefae2653e9cdc78 < 4c65507121ea8e0b47fae6d2049c8688390d46b6`
- `Linux >= af42269c3523492d71ebbe11fefae2653e9cdc78 < de1bf25b6d771abdb52d43546cf57ad775fb68a1`
- `Linux 2f3a124696d43de3c837f87a9f767c56ee86cf2a`
- `Linux >= 5.15.133 < 5.15.151`
- `Linux >= 6.1.55 < 6.1.81`
- `Linux >= 6.5.5 < 6.6`
- `Linux 6.6`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.