---
id: CVE-2024-53090
title: 'afs: Fix lock recursion'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  afs: Fix lock recursion

  afs_wake_up_async_call() can incur lock recursion.  The problem is that it
  is called from AF_RXRPC whilst holding the ->notify_lock, but it tri…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 20acbd9a7aeee0b0af7107f3de791a52c949f3ac <
    d256a7f2385cf59d09526c794367d44fd7a26c7a
  - >-
    Linux >= 20acbd9a7aeee0b0af7107f3de791a52c949f3ac <
    9ada9ff6339d49df2260bb876ccf895d88928f81
  - >-
    Linux >= 20acbd9a7aeee0b0af7107f3de791a52c949f3ac <
    d7cbf81df996b1eae2dee8deb6df08e2eba78661
  - >-
    Linux >= 20acbd9a7aeee0b0af7107f3de791a52c949f3ac <
    610a79ffea02102899a1373fe226d949944a7ed6
  - Linux 4.15
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2025-10-01T20:11:33.834587Z'
published: '2024-11-21'
updated: '2026-10-30'
sourceUpdated: '2026-10-30T12:19:58.981Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2024-53090'
references:
  - url: 'https://git.kernel.org/stable/c/d256a7f2385cf59d09526c794367d44fd7a26c7a'
  - url: 'https://git.kernel.org/stable/c/9ada9ff6339d49df2260bb876ccf895d88928f81'
  - url: 'https://git.kernel.org/stable/c/d7cbf81df996b1eae2dee8deb6df08e2eba78661'
  - url: 'https://git.kernel.org/stable/c/610a79ffea02102899a1373fe226d949944a7ed6'
tags:
  - cve.org
epss: 0.00675
epssPercentile: 0.52166
ingestedAt: '2026-10-21T12:48:53.728Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

afs: Fix lock recursion

afs_wake_up_async_call() can incur lock recursion.  The problem is that it
is called from AF_RXRPC whilst holding the ->notify_lock, but it tries to
take a ref on the afs_call struct in order to pass it to a work queue - but
if the afs_call is already queued, we then have an extraneous ref that must
be put... calling afs_put_call() may call back down into AF_RXRPC through
rxrpc_kernel_shutdown_call(), however, which might try taking the
->notify_lock again.

This case isn't very common, however, so defer it to a workqueue.  The oops
looks something like:

  BUG: spinlock recursion on CPU#0, krxrpcio/7001/1646
   lock: 0xffff888141399b30, .magic: dead4ead, .owner: krxrpcio/7001/1646, .owner_cpu: 0
  CPU: 0 UID: 0 PID: 1646 Comm: krxrpcio/7001 Not tainted 6.12.0-rc2-build3+ #4351
  Hardware name: ASUS All Series/H97-PLUS, BIOS 2306 10/09/2014
  Call Trace:
   <TASK>
   dump_stack_lvl+0x47/0x70
   do_raw_spin_lock+0x3c/0x90
   rxrpc_kernel_shutdown_call+0x83/0xb0
   afs_put_call+0xd7/0x180
   rxrpc_notify_socket+0xa0/0x190
   rxrpc_input_split_jumbo+0x198/0x1d0
   rxrpc_input_data+0x14b/0x1e0
   ? rxrpc_input_call_packet+0xc2/0x1f0
   rxrpc_input_call_event+0xad/0x6b0
   rxrpc_input_packet_on_conn+0x1e1/0x210
   rxrpc_input_packet+0x3f2/0x4d0
   rxrpc_io_thread+0x243/0x410
   ? __pfx_rxrpc_io_thread+0x10/0x10
   kthread+0xcf/0xe0
   ? __pfx_kthread+0x10/0x10
   ret_from_fork+0x24/0x40
   ? __pfx_kthread+0x10/0x10
   ret_from_fork_asm+0x1a/0x30
   </TASK>

## Affected

- `Linux >= 20acbd9a7aeee0b0af7107f3de791a52c949f3ac < d256a7f2385cf59d09526c794367d44fd7a26c7a`
- `Linux >= 20acbd9a7aeee0b0af7107f3de791a52c949f3ac < 9ada9ff6339d49df2260bb876ccf895d88928f81`
- `Linux >= 20acbd9a7aeee0b0af7107f3de791a52c949f3ac < d7cbf81df996b1eae2dee8deb6df08e2eba78661`
- `Linux >= 20acbd9a7aeee0b0af7107f3de791a52c949f3ac < 610a79ffea02102899a1373fe226d949944a7ed6`
- `Linux 4.15`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.