---
id: CVE-2024-56584
title: 'io_uring/tctx: work around xa_store() allocation error issue'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  io_uring/tctx: work around xa_store() allocation error issue

  syzbot triggered the following WARN_ON:

  WARNING: CPU: 0 PID: 16 at io_uring/tctx.c:51 __io_uring_free+0xf…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 2b188cc1bb857a9d4701ae59aa7768b5124e262e <
    e05c070b401f6365c503e2b59f091331965c4fb9
  - >-
    Linux >= 2b188cc1bb857a9d4701ae59aa7768b5124e262e <
    3a84fa784710990964c1e35df743851ab2863898
  - >-
    Linux >= 2b188cc1bb857a9d4701ae59aa7768b5124e262e <
    94ad56f61b873ffeebcc620d451eacfbdf9d40f0
  - >-
    Linux >= 2b188cc1bb857a9d4701ae59aa7768b5124e262e <
    42882b583095dcf747da6e3af1daeff40e27033e
  - >-
    Linux >= 2b188cc1bb857a9d4701ae59aa7768b5124e262e <
    d5b2ddf1f90c7248eff9630b95895c8950f2f36d
  - >-
    Linux >= 2b188cc1bb857a9d4701ae59aa7768b5124e262e <
    7eb75ce7527129d7f1fee6951566af409a37a1c4
  - Linux 5.1
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-05T20:28:57.530482Z'
published: '2024-12-27'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T20:31:24.360Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2024-56584'
references:
  - url: 'https://git.kernel.org/stable/c/e05c070b401f6365c503e2b59f091331965c4fb9'
  - url: 'https://git.kernel.org/stable/c/3a84fa784710990964c1e35df743851ab2863898'
  - url: 'https://git.kernel.org/stable/c/94ad56f61b873ffeebcc620d451eacfbdf9d40f0'
  - url: 'https://git.kernel.org/stable/c/42882b583095dcf747da6e3af1daeff40e27033e'
  - url: 'https://git.kernel.org/stable/c/d5b2ddf1f90c7248eff9630b95895c8950f2f36d'
  - url: 'https://git.kernel.org/stable/c/7eb75ce7527129d7f1fee6951566af409a37a1c4'
tags:
  - cve.org
epss: 0.00238
epssPercentile: 0.14879
ingestedAt: '2026-11-05T22:38:31.833Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

io_uring/tctx: work around xa_store() allocation error issue

syzbot triggered the following WARN_ON:

WARNING: CPU: 0 PID: 16 at io_uring/tctx.c:51 __io_uring_free+0xfa/0x140 io_uring/tctx.c:51

which is the

WARN_ON_ONCE(!xa_empty(&tctx->xa));

sanity check in __io_uring_free() when a io_uring_task is going through
its final put. The syzbot test case includes injecting memory allocation
failures, and it very much looks like xa_store() can fail one of its
memory allocations and end up with ->head being non-NULL even though no
entries exist in the xarray.

Until this issue gets sorted out, work around it by attempting to
iterate entries in our xarray, and WARN_ON_ONCE() if one is found.

## Affected

- `Linux >= 2b188cc1bb857a9d4701ae59aa7768b5124e262e < e05c070b401f6365c503e2b59f091331965c4fb9`
- `Linux >= 2b188cc1bb857a9d4701ae59aa7768b5124e262e < 3a84fa784710990964c1e35df743851ab2863898`
- `Linux >= 2b188cc1bb857a9d4701ae59aa7768b5124e262e < 94ad56f61b873ffeebcc620d451eacfbdf9d40f0`
- `Linux >= 2b188cc1bb857a9d4701ae59aa7768b5124e262e < 42882b583095dcf747da6e3af1daeff40e27033e`
- `Linux >= 2b188cc1bb857a9d4701ae59aa7768b5124e262e < d5b2ddf1f90c7248eff9630b95895c8950f2f36d`
- `Linux >= 2b188cc1bb857a9d4701ae59aa7768b5124e262e < 7eb75ce7527129d7f1fee6951566af409a37a1c4`
- `Linux 5.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.