Executive brief
A vulnerability in the Linux kernel's block control group (blk-cgroup) component could allow a local user to cause a system resource leak. Specifically, the system fails to properly release references to block devices when gathering input/output statistics. Over time, this 'refcount leakage' can prevent system components from being properly shut down or reconfigured, potentially leading to a denial-of-service condition where the system becomes unstable or fails to manage storage resources.
Technical details
A reference count leak exists in the Linux kernel's block control group (blk-cgroup) subsystem. The function blkcg_fill_root_iostats() iterates over devices in @block_class using class_dev_iter_init() and class_dev_iter_next(), but fails to call class_dev_iter_exit() upon completion. This omission prevents the subsystem's reference counter from being decremented correctly. An attacker with local access could potentially exploit this to cause a denial-of-service by exhausting system resources or preventing the proper release of kernel structures. The issue has been resolved in various stable branches including 6.1.129, 6.6.78, 6.12.14, and 6.13.3.
Affected products
- Linux Linux Kernel 5.9 to 6.1.129, 6.2 to 6.6.78, 6.7 to 6.12.14, 6.13 to 6.13.3
Timeline
- 2025-01-05: other: Patch authored
- 2025-02-17: patched: Patch committed to stable trees
- 2025-02-27: advisory: NVD advisory published
References
- https://git.kernel.org/stable/c/2ce09aabe009453d641a2ceb79e6461a2d4f3876
- https://git.kernel.org/stable/c/38287f779b34dfe959b4b681e909f2d3d52b88be
- https://git.kernel.org/stable/c/431b6ef2714be4d5babb802114987541a88b43b0
- https://git.kernel.org/stable/c/67c7f213e052b1aa6caba4a7e25e303bc6997126
- https://git.kernel.org/stable/c/993121481b5a87829f1e8163f47158b72679f309
- https://git.kernel.org/stable/c/d1248436cbef1f924c04255367ff4845ccd9025e
- https://git.kernel.org/stable/c/ffb494f1e7a047bd7a41b13796fcfb08fe5beafb