---
id: CVE-2024-40995
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  net/sched: act_api: fix possible infinite loop in tcf_idr_check_alloc()

  syzbot found hanging tasks waiting on rtnl_lock [1]

  A reproducer is available in the syzbot bu…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  net/sched: act_api: fix possible infinite loop in tcf_idr_check_alloc()

  syzbot found hanging tasks waiting on rtnl_lock [1]

  A reproducer is available in the syzbot bu…
severity: medium
cvss: 5.5
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-835
vendor: linux
product: linux_kernel
affected:
  - 'linux_kernel >= 4.19, < 5.4.279'
  - 'linux_kernel >= 5.5, < 5.10.221'
  - 'linux_kernel >= 5.11, < 5.15.162'
  - 'linux_kernel >= 5.16, < 6.1.96'
  - 'linux_kernel >= 6.2, < 6.6.36'
  - 'linux_kernel >= 6.7, < 6.9.7'
  - linux_kernel = 6.10
patched:
  - linux_kernel 6.9.7
published: '2024-07-12'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T01:18:40.383'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2024-40995'
references:
  - url: 'https://git.kernel.org/stable/c/0d8a2d287c8a394c0d4653f0c6c7be4c688e5a74'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/25987a97eec4d5f897cd04ee1b45170829c610da'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/5f926aa96b08b6c47178fe1171e7ae331c695fc2'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/6fc78d67f51aeb9a542d39a8714e16bc411582d4'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/7a0e497b597df7c4cf2b63fc6e9188b6cabe5335'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/c6a7da65a296745535a964be1019ec7691b0cb90'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/d864319871b05fadd153e0aede4811ca7008f5d6'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/0d8a2d287c8a394c0d4653f0c6c7be4c688e5a74'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://git.kernel.org/stable/c/25987a97eec4d5f897cd04ee1b45170829c610da'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://git.kernel.org/stable/c/5f926aa96b08b6c47178fe1171e7ae331c695fc2'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://git.kernel.org/stable/c/6fc78d67f51aeb9a542d39a8714e16bc411582d4'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://git.kernel.org/stable/c/7a0e497b597df7c4cf2b63fc6e9188b6cabe5335'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://git.kernel.org/stable/c/c6a7da65a296745535a964be1019ec7691b0cb90'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://git.kernel.org/stable/c/d864319871b05fadd153e0aede4811ca7008f5d6'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-265688.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-355557.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-613116.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
tags:
  - nvd
  - cve.org
epss: 0.00289
epssPercentile: 0.21304
ingestedAt: '2026-10-15T03:30:12.724Z'
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2024-09-10T17:01:35.312165Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

net/sched: act_api: fix possible infinite loop in tcf_idr_check_alloc()

syzbot found hanging tasks waiting on rtnl_lock [1]

A reproducer is available in the syzbot bug.

When a request to add multiple actions with the same index is sent, the
second request will block forever on the first request. This holds
rtnl_lock, and causes tasks to hang.

Return -EAGAIN to prevent infinite looping, while keeping documented
behavior.

[1]

INFO: task kworker/1:0:5088 blocked for more than 143 seconds.
Not tainted 6.9.0-rc4-syzkaller-00173-g3cdb45594619 #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/1:0 state:D stack:23744 pid:5088 tgid:5088 ppid:2 flags:0x00004000
Workqueue: events_power_efficient reg_check_chans_work
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5409 [inline]
__schedule+0xf15/0x5d00 kernel/sched/core.c:6746
__schedule_loop kernel/sched/core.c:6823 [inline]
schedule+0xe7/0x350 kernel/sched/core.c:6838
schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:6895
__mutex_lock_common kernel/locking/mutex.c:684 [inline]
__mutex_lock+0x5b8/0x9c0 kernel/locking/mutex.c:752
wiphy_lock include/net/cfg80211.h:5953 [inline]
reg_leave_invalid_chans net/wireless/reg.c:2466 [inline]
reg_check_chans_work+0x10a/0x10e0 net/wireless/reg.c:2481

## Affected

- `linux_kernel >= 4.19, < 5.4.279`
- `linux_kernel >= 5.5, < 5.10.221`
- `linux_kernel >= 5.11, < 5.15.162`
- `linux_kernel >= 5.16, < 6.1.96`
- `linux_kernel >= 6.2, < 6.6.36`
- `linux_kernel >= 6.7, < 6.9.7`
- `linux_kernel = 6.10`

## Remediation

Upgrade past the affected range:

- `linux_kernel 6.9.7`