{
  "schema_version": "1.6.1",
  "id": "RPI-CVE-2024-56693",
  "modified": "2026-10-07T17:22:01Z",
  "upstream": [
    "CVE-2024-56693"
  ],
  "published": "2024-12-28T09:46:17Z",
  "summary": "brd: defer automatic disk creation until module initialization succeeds",
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nbrd: defer automatic disk creation until module initialization succeeds\n\nMy colleague Wupeng found the following problems during fault injection:\n\nBUG: unable to handle page fault for address: fffffbfff809d073\nPGD 6e648067 P4D 123ec8067 PUD 123ec4067 PMD 100e38067 PTE 0\nOops: Oops: 0000 [#1] PREEMPT SMP KASAN NOPTI\nCPU: 5 UID: 0 PID: 755 Comm: modprobe Not tainted 6.12.0-rc3+ #17\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS\n1.16.1-2.fc37 04/01/2014\nRIP: 0010:__asan_load8+0x4c/0xa0\n...\nCall Trace:\n <TASK>\n blkdev_put_whole+0x41/0x70\n bdev_release+0x1a3/0x250\n blkdev_release+0x11/0x20\n __fput+0x1d7/0x4a0\n task_work_run+0xfc/0x180\n syscall_exit_to_user_mode+0x1de/0x1f0\n do_syscall_64+0x6b/0x170\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\nloop_init() is calling loop_add() after __register_blkdev() succeeds and\nis ignoring disk_add() failure from loop_add(), for loop_add() failure\nis not fatal and successfully created disks are already visible to\nbdev_open().\n\nbrd_init() is currently calling brd_alloc() before __register_blkdev()\nsucceeds and is releasing successfully created disks when brd_init()\nreturns an error. This can cause UAF for the latter two case:\n\ncase 1:\n    T1:\nmodprobe brd\n  brd_init\n    brd_alloc(0) // success\n      add_disk\n        disk_scan_partitions\n          bdev_file_open_by_dev // alloc file\n          fput // won't free until back to userspace\n    brd_alloc(1) // failed since mem alloc error inject\n  // error path for modprobe will release code segment\n  // back to userspace\n  __fput\n    blkdev_release\n      bdev_release\n        blkdev_put_whole\n          bdev->bd_disk->fops->release // fops is freed now, UAF!\n\ncase 2:\n    T1:                            T2:\nmodprobe brd\n  brd_init\n    brd_alloc(0) // success\n                                   open(/dev/ram0)\n    brd_alloc(1) // fail\n  // error path for modprobe\n\n                                   close(/dev/ram0)\n                                   ...\n                                   /* UAF! */\n                                   bdev->bd_disk->fops->release\n\nFix this problem by following what loop_init() does. Besides,\nreintroduce brd_devices_mutex to help serialize modifications to\nbrd_list.",
  "affected": [
    {
      "package": {
        "ecosystem": "Raspberry Pi OS:12",
        "name": "linux"
      },
      "versions": [
        "1:6.1.21-1+rpt1",
        "1:6.1.47-1+rpt2",
        "1:6.1.47-1+rpt4",
        "1:6.1.54-1+rpt2",
        "1:6.1.58-1+rpt2",
        "1:6.1.63-1+rpt1",
        "1:6.1.73-1+rpt1",
        "1:6.6.20-1+rpt1",
        "1:6.6.28-1+rpt1",
        "1:6.6.31-1+rpt1",
        "1:6.6.47-1+rpt1",
        "1:6.6.51-1+rpt1",
        "1:6.6.51-1+rpt2",
        "1:6.6.51-1+rpt3",
        "1:6.6.62-1+rpt1"
      ],
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "linux-image-6.1.0-rpi1-rpi-v6",
            "binary_version": "1:6.1.21-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi1-rpi-v7",
            "binary_version": "1:6.1.21-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi1-rpi-v7l",
            "binary_version": "1:6.1.21-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi1-rpi-v8",
            "binary_version": "1:6.1.21-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi2-rpi-v6",
            "binary_version": "1:6.1.47-1+rpt2"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi2-rpi-v7",
            "binary_version": "1:6.1.47-1+rpt2"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi2-rpi-v7l",
            "binary_version": "1:6.1.47-1+rpt2"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi2-rpi-v8",
            "binary_version": "1:6.1.47-1+rpt2"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-2712",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v6",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v7",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v7l",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v8",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi4-rpi-2712",
            "binary_version": "1:6.1.54-1+rpt2"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi4-rpi-v6",
            "binary_version": "1:6.1.54-1+rpt2"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi4-rpi-v7",
            "binary_version": "1:6.1.54-1+rpt2"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi4-rpi-v7l",
            "binary_version": "1:6.1.54-1+rpt2"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi4-rpi-v8",
            "binary_version": "1:6.1.54-1+rpt2"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi6-rpi-2712",
            "binary_version": "1:6.1.58-1+rpt2"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi6-rpi-v6",
            "binary_version": "1:6.1.58-1+rpt2"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi6-rpi-v7",
            "binary_version": "1:6.1.58-1+rpt2"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi6-rpi-v7l",
            "binary_version": "1:6.1.58-1+rpt2"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi6-rpi-v8",
            "binary_version": "1:6.1.58-1+rpt2"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi7-rpi-2712",
            "binary_version": "1:6.1.63-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi7-rpi-v6",
            "binary_version": "1:6.1.63-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi7-rpi-v7",
            "binary_version": "1:6.1.63-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi7-rpi-v7l",
            "binary_version": "1:6.1.63-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi7-rpi-v8",
            "binary_version": "1:6.1.63-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi8-rpi-2712",
            "binary_version": "1:6.1.73-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi8-rpi-v6",
            "binary_version": "1:6.1.73-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi8-rpi-v7",
            "binary_version": "1:6.1.73-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi8-rpi-v7l",
            "binary_version": "1:6.1.73-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi8-rpi-v8",
            "binary_version": "1:6.1.73-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.6.20+rpt-rpi-2712",
            "binary_version": "1:6.6.20-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.6.20+rpt-rpi-v6",
            "binary_version": "1:6.6.20-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.6.20+rpt-rpi-v7",
            "binary_version": "1:6.6.20-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.6.20+rpt-rpi-v7l",
            "binary_version": "1:6.6.20-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.6.20+rpt-rpi-v8",
            "binary_version": "1:6.6.20-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.6.28+rpt-rpi-2712",
            "binary_version": "1:6.6.28-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.6.28+rpt-rpi-v6",
            "binary_version": "1:6.6.28-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.6.28+rpt-rpi-v7",
            "binary_version": "1:6.6.28-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.6.28+rpt-rpi-v7l",
            "binary_version": "1:6.6.28-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.6.28+rpt-rpi-v8",
            "binary_version": "1:6.6.28-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.6.31+rpt-rpi-2712",
            "binary_version": "1:6.6.31-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.6.31+rpt-rpi-v6",
            "binary_version": "1:6.6.31-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.6.31+rpt-rpi-v7",
            "binary_version": "1:6.6.31-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.6.31+rpt-rpi-v7l",
            "binary_version": "1:6.6.31-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.6.31+rpt-rpi-v8",
            "binary_version": "1:6.6.31-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.6.47+rpt-rpi-2712",
            "binary_version": "1:6.6.47-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.6.47+rpt-rpi-v6",
            "binary_version": "1:6.6.47-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.6.47+rpt-rpi-v7",
            "binary_version": "1:6.6.47-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.6.47+rpt-rpi-v7l",
            "binary_version": "1:6.6.47-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.6.47+rpt-rpi-v8",
            "binary_version": "1:6.6.47-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.6.51+rpt-rpi-2712",
            "binary_version": "1:6.6.51-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.6.51+rpt-rpi-v6",
            "binary_version": "1:6.6.51-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.6.51+rpt-rpi-v7",
            "binary_version": "1:6.6.51-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.6.51+rpt-rpi-v7l",
            "binary_version": "1:6.6.51-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.6.51+rpt-rpi-v8",
            "binary_version": "1:6.6.51-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.6.51+rpt-rpi-2712",
            "binary_version": "1:6.6.51-1+rpt2"
          },
          {
            "binary_name": "linux-image-6.6.51+rpt-rpi-v6",
            "binary_version": "1:6.6.51-1+rpt2"
          },
          {
            "binary_name": "linux-image-6.6.51+rpt-rpi-v7",
            "binary_version": "1:6.6.51-1+rpt2"
          },
          {
            "binary_name": "linux-image-6.6.51+rpt-rpi-v7l",
            "binary_version": "1:6.6.51-1+rpt2"
          },
          {
            "binary_name": "linux-image-6.6.51+rpt-rpi-v8",
            "binary_version": "1:6.6.51-1+rpt2"
          },
          {
            "binary_name": "linux-image-6.6.51+rpt-rpi-2712",
            "binary_version": "1:6.6.51-1+rpt3"
          },
          {
            "binary_name": "linux-image-6.6.51+rpt-rpi-v6",
            "binary_version": "1:6.6.51-1+rpt3"
          },
          {
            "binary_name": "linux-image-6.6.51+rpt-rpi-v7",
            "binary_version": "1:6.6.51-1+rpt3"
          },
          {
            "binary_name": "linux-image-6.6.51+rpt-rpi-v7l",
            "binary_version": "1:6.6.51-1+rpt3"
          },
          {
            "binary_name": "linux-image-6.6.51+rpt-rpi-v8",
            "binary_version": "1:6.6.51-1+rpt3"
          },
          {
            "binary_name": "linux-image-6.6.62+rpt-rpi-2712",
            "binary_version": "1:6.6.62-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.6.62+rpt-rpi-v6",
            "binary_version": "1:6.6.62-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.6.62+rpt-rpi-v7",
            "binary_version": "1:6.6.62-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.6.62+rpt-rpi-v7l",
            "binary_version": "1:6.6.62-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.6.62+rpt-rpi-v8",
            "binary_version": "1:6.6.62-1+rpt1"
          }
        ]
      },
      "database_specific": {
        "per_version": {
          "1:6.1.21-1+rpt1": {
            "linux_commit": "0afb5e98488aed7017b9bf321b575d0177feb7ed",
            "upstream_version": "6.1.21",
            "assessment": "commit ancestry (strak rule)",
            "upstream_fixed": "6.1.120"
          },
          "1:6.1.47-1+rpt2": {
            "linux_commit": "655fc658a15ae7a6f37103754adb39ba52a9a14e",
            "upstream_version": "6.1.47",
            "assessment": "commit ancestry (strak rule)",
            "upstream_fixed": "6.1.120"
          },
          "1:6.1.47-1+rpt4": {
            "linux_commit": "655fc658a15ae7a6f37103754adb39ba52a9a14e",
            "upstream_version": "6.1.47",
            "assessment": "commit ancestry (strak rule)",
            "upstream_fixed": "6.1.120",
            "compiled_filter": false
          },
          "1:6.1.54-1+rpt2": {
            "linux_commit": "2906f7abdc03d4a92b6b0e2e0c87ea2a9dffe8f7",
            "upstream_version": "6.1.54",
            "assessment": "commit ancestry (strak rule)",
            "upstream_fixed": "6.1.120"
          },
          "1:6.1.58-1+rpt2": {
            "linux_commit": "ccf1586ad0663fa91238ac56abf6340d6d740d18",
            "upstream_version": "6.1.58",
            "assessment": "commit ancestry (strak rule)",
            "upstream_fixed": "6.1.120"
          },
          "1:6.1.63-1+rpt1": {
            "linux_commit": null,
            "upstream_version": "6.1.63",
            "assessment": "upstream version (no usable Linux commit)",
            "upstream_fixed": "6.1.120"
          },
          "1:6.1.73-1+rpt1": {
            "linux_commit": null,
            "upstream_version": "6.1.73",
            "assessment": "upstream version (no usable Linux commit)",
            "upstream_fixed": "6.1.120"
          },
          "1:6.6.20-1+rpt1": {
            "linux_commit": "6f16847710cc0502450788b9f12f0a14d3429668",
            "upstream_version": "6.6.20",
            "assessment": "commit ancestry (strak rule)",
            "upstream_fixed": "6.6.64"
          },
          "1:6.6.28-1+rpt1": {
            "linux_commit": "0c341f47adc3578cd5f817aa20ee2b7f9ae6b23e",
            "upstream_version": "6.6.28",
            "assessment": "commit ancestry (strak rule)",
            "upstream_fixed": "6.6.64"
          },
          "1:6.6.31-1+rpt1": {
            "linux_commit": "c1432b4bae5b6582f4d32ba381459f33c34d1424",
            "upstream_version": "6.6.31",
            "assessment": "commit ancestry (strak rule)",
            "upstream_fixed": "6.6.64"
          },
          "1:6.6.47-1+rpt1": {
            "linux_commit": "cf64a1dfecc2dc418efdd61701c1a4b185ab4761",
            "upstream_version": "6.6.47",
            "assessment": "commit ancestry (strak rule)",
            "upstream_fixed": "6.6.64"
          },
          "1:6.6.51-1+rpt1": {
            "linux_commit": "0094eba3f2a4338cfa6854b0b5104d02ba0fa01f",
            "upstream_version": "6.6.51",
            "assessment": "commit ancestry (strak rule)",
            "upstream_fixed": "6.6.64"
          },
          "1:6.6.51-1+rpt2": {
            "linux_commit": "82a50e430ef1d6eb37d78e25aa572c1f6ea56160",
            "upstream_version": "6.6.51",
            "assessment": "commit ancestry (strak rule)",
            "upstream_fixed": "6.6.64"
          },
          "1:6.6.51-1+rpt3": {
            "linux_commit": "5aeecea9f4a45248bcf564dec924965e066a7bfd",
            "upstream_version": "6.6.51",
            "assessment": "commit ancestry (strak rule)",
            "upstream_fixed": "6.6.64"
          },
          "1:6.6.62-1+rpt1": {
            "linux_commit": "dd2394360860d15146c96635796a75b05bb32b61",
            "upstream_version": "6.6.62",
            "assessment": "commit ancestry (strak rule)",
            "upstream_fixed": "6.6.64"
          }
        }
      }
    }
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-56693"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/41219c147df8bbd6591f59af5d695fb6c9a1cbff"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/259bf925583ec9e3781df778cadf00594095090d"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/410896624db639500f24f46478b4bfa05c76bf56"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/c0c2744cd2939ec5999c51dbaf2af16886548b7b"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/63dfd728b30f79495dacc886127695a379805152"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/826cc42adf44930a633d11a5993676d85ddb0842"
    }
  ],
  "database_specific": {
    "source": "https://git.kernel.org/pub/scm/linux/security/vulns.git",
    "upstream_modified": "2026-08-05T11:52:36Z"
  }
}