VYPR
← All advisories
High severity7.1NVD Advisory· Published May 30, 2024· Updated May 12, 2026

CVE-2024-36916

CVE-2024-36916

Description

In the Linux kernel, the following vulnerability has been resolved:

blk-iocost: avoid out of bounds shift

UBSAN catches undefined behavior in blk-iocost, where sometimes iocg->delay is shifted right by a number that is too large, resulting in undefined behavior on some architectures.

[ 186.556576] ------------[ cut here ]------------ UBSAN: shift-out-of-bounds in block/blk-iocost.c:1366:23 shift exponent 64 is too large for 64-bit type 'u64' (aka 'unsigned long long') CPU: 16 PID: 0 Comm: swapper/16 Tainted: G S E N 6.9.0-0_fbk700_debug_rc2_kbuilder_0_gc85af715cac0 #1 Hardware name: Quanta Twin Lakes MP/Twin Lakes Passive MP, BIOS F09_3A23 12/08/2020 Call Trace:

dump_stack_lvl+0x8f/0xe0 __ubsan_handle_shift_out_of_bounds+0x22c/0x280 iocg_kick_delay+0x30b/0x310 ioc_timer_fn+0x2fb/0x1f80 __run_timer_base+0x1b6/0x250 ...

Avoid that undefined behavior by simply taking the "delay = 0" branch if the shift is too large.

I am not sure what the symptoms of an undefined value delay will be, but I suspect it could be more than a little annoying to debug.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

In the Linux kernel's blk-iocost, a shift-out-of-bounds in iocg->delay handling can cause undefined behavior, leading to a potential denial of service.

Vulnerability

Details

In the Linux kernel's block I/O cost controller (blk-iocost), a shift-out-of-bounds error occurs in the iocg_kick_delay function. The shift exponent 64 is too large for a 64-bit variable, causing undefined behavior according to UBSAN reports [1][2]. The root cause is that iocg->delay is shifted right by an excessive number of bits when iocg->delay is 0 and the shift count equals 64 [description].

Exploitation

Scenario

This bug can be triggered by the kernel's timer callback ioc_timer_fn, which runs in IRQ context without requiring any special user privileges. An attacker with local access or the ability to influence I/O patterns may cause the shift condition to occur. The issue manifests as a crash or unpredictable system behavior due to the undefined shift operation [description].

Impact

Successful exploitation leads to a denial of service (system crash or hang) due to undefined behavior in the kernel. The impact is limited to confidentiality, integrity, and availability being affected depending on the system state, but primarily availability is at risk [2].

Mitigation

The fix is to simply take the delay = 0 path when the shift would be too large, as implemented in kernel commits [3][4]. Patched versions of the Linux kernel are available; users should update their kernels. The vulnerability is also addressed in Siemens SIMATIC S7-1500 TM MFP GNU/Linux subsystem [2].

References
  1. SSA-613116
  2. SSA-265688
  3. Making sure you're not a bot!
  4. Making sure you're not a bot!

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

95

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

10

News mentions

0

No linked articles in our index yet.