VYPR
← All advisories
High severity7.1NVD Advisory· Published Jan 19, 2025· Updated May 12, 2026

CVE-2024-57929

CVE-2024-57929

Description

In the Linux kernel, the following vulnerability has been resolved:

dm array: fix releasing a faulty array block twice in dm_array_cursor_end

When dm_bm_read_lock() fails due to locking or checksum errors, it releases the faulty block implicitly while leaving an invalid output pointer behind. The caller of dm_bm_read_lock() should not operate on this invalid dm_block pointer, or it will lead to undefined result. For example, the dm_array_cursor incorrectly caches the invalid pointer on reading a faulty array block, causing a double release in dm_array_cursor_end(), then hitting the BUG_ON in dm-bufio cache_put().

Reproduce steps:

  1. initialize a cache device

dmsetup create cmeta --table "0 8192 linear /dev/sdc 0" dmsetup create cdata --table "0 65536 linear /dev/sdc 8192" dmsetup create corig --table "0 524288 linear /dev/sdc $262144" dd if=/dev/zero of=/dev/mapper/cmeta bs=4k count=1 dmsetup create cache --table "0 524288 cache /dev/mapper/cmeta \ /dev/mapper/cdata /dev/mapper/corig 128 2 metadata2 writethrough smq 0"

  1. wipe the second array block offline

dmsteup remove cache cmeta cdata corig mapping_root=$(dd if=/dev/sdc bs=1c count=8 skip=192 \ 2>/dev/null | hexdump -e '1/8 "%u\n"') ablock=$(dd if=/dev/sdc bs=1c count=8 skip=$((4096*mapping_root+2056)) \ 2>/dev/null | hexdump -e '1/8 "%u\n"') dd if=/dev/zero of=/dev/sdc bs=4k count=1 seek=$ablock

  1. try reopen the cache device

dmsetup create cmeta --table "0 8192 linear /dev/sdc 0" dmsetup create cdata --table "0 65536 linear /dev/sdc 8192" dmsetup create corig --table "0 524288 linear /dev/sdc $262144" dmsetup create cache --table "0 524288 cache /dev/mapper/cmeta \ /dev/mapper/cdata /dev/mapper/corig 128 2 metadata2 writethrough smq 0"

Kernel logs:

(snip) device-mapper: array: array_block_check failed: blocknr 0 != wanted 10 device-mapper: block manager: array validator check failed for block 10 device-mapper: array: get_ablock failed device-mapper: cache metadata: dm_array_cursor_next for mapping failed ------------[ cut here ]------------ kernel BUG at drivers/md/dm-bufio.c:638!

Fix by setting the cached block pointer to NULL on errors.

In addition to the reproducer described above, this fix can be verified using the "array_cursor/damaged" test in dm-unit: dm-unit run /pdata/array_cursor/damaged --kernel-dir <KERNEL_DIR>

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

In the Linux kernel, dm_array_cursor incorrectly caches a faulty array block pointer, leading to a double release and a BUG_ON in dm-bufio.

Vulnerability

Description CVE-2024-57929 is a bug in the Linux kernel's device mapper (dm) array subsystem. When dm_bm_read_lock() fails due to locking or checksum errors, it releases the faulty block implicitly but leaves an invalid output pointer behind. The dm_array_cursor code incorrectly caches this invalid pointer on reading a faulty array block, causing a double release in dm_array_cursor_end(), which hits the BUG_ON in dm-bufio cache_put().

Attack

Surface and Exploitation The vulnerability can be triggered by an attacker who can manipulate the metadata of a cache device, for example by wiping the second array block offline as described in the official description [1]. The attack requires the ability to write to the underlying block device and then reload the cache device. No special privileges beyond those needed to set up the device mapper are required. The attack results in a kernel crash (BUG_ON) leading to a denial of service.

Impact

An attacker who can corrupt the metadata of a dm-cache device can cause the kernel to crash when the device is reopened, leading to a denial of service. This is a high-severity issue (CVSS v3 7.1) as it can be exploited locally with low complexity.

Mitigation

The fix is included in the Linux kernel stable releases [2][3][4]. Users should update their kernel to a version containing the commit. Siemens has confirmed that the SIMATIC S7-1500 TM MFP - GNU/Linux subsystem is affected [1] and recommends updating as per their advisory.

References
  1. SSA-265688
  2. Making sure you're not a bot!
  3. Making sure you're not a bot!
  4. Making sure you're not a bot!

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

72

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

10

News mentions

0

No linked articles in our index yet.