APPLIED: [SRU][J][PATCH 0/1] CVE-2024-54683

[Stefan Bader]

On 09/09/2026 13:42, Cengiz Can via kernel-team wrote:
> https://ubuntu.com/security/CVE-2024-54683
> 
> [ Impact ]
> 
> In the Linux kernel, the following vulnerability has been resolved:
> 
> netfilter: IDLETIMER: Fix for possible ABBA deadlock
> 
> Deletion of the last rule referencing a given idletimer may happen at the same
> time as a read of its file in sysfs:
> 
> | ======================================================
> | WARNING: possible circular locking dependency detected
> | 6.12.0-rc7-01692-g5e9a28f41134-dirty #594 Not tainted
> | ------------------------------------------------------
> | iptables/3303 is trying to acquire lock:
> | ffff8881057e04b8 (kn->active#48){++++}-{0:0}, at: __kernfs_remove+0x20
> |
> | but task is already holding lock:
> | ffffffffa0249068 (list_mutex){+.+.}-{3:3}, at: idletimer_tg_destroy_v]
> |
> | which lock already depends on the new lock.
> 
> A simple reproducer is:
> 
> | #!/bin/bash
> |
> | while true; do
> |         iptables -A INPUT -i foo -j IDLETIMER --timeout 10 --label "testme"
> |         iptables -D INPUT -i foo -j IDLETIMER --timeout 10 --label "testme"
> | done &
> | while true; do
> |         cat /sys/class/xt_idletimer/timers/testme >/dev/null
> | done
> 
> Avoid this by freeing list_mutex right after deleting the element from the
> list, then continuing with the teardown.
> 
> [ Fix ]
> 
> jammy/linux: backported from f36b01994d68
> 
> The backport keeps this tree's del_timer_sync() rather than upstream's
> timer_shutdown_sync() in both destroy functions, since timer_shutdown_sync()
> does not exist in this older tree. Functionally the change moves the
> list_mutex unlock to immediately after the element is removed from the list,
> so the remaining teardown (including sysfs removal) no longer runs while
> list_mutex is held, breaking the lock cycle.
> 
> [ Test Plan ]
> 
> Build and boot tested.
> 
> [ Where Problems Could Occur ]
> 
> A bad fix would affect systems that use the netfilter xt_IDLETIMER target,
> typically iptables/ip6tables rules employing "-j IDLETIMER" together with the
> sysfs timer files under /sys/class/xt_idletimer/timers/; regressions could
> manifest as timer teardown races, use-after-free, or stale sysfs entries when
> rules are rapidly added and deleted. Systems that do not load the
> xt_IDLETIMER module or do not use IDLETIMER rules are not affected.
> 
> [ Other Info ]
> 
> Kybele flow-v11-22-gf3c7ff80. Reference: c437e6d4/v1
> 

Applied to jammy:linux/master-next. Thanks.

-Stefan
-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/kernel-team/attachments/20260916/b937dae1/attachment.sig>