{"cve":"CVE-2024-27023","nvd":{"published":"2024-05-01T13:15:48.797","modified":"2026-06-17T07:18:57.947","status":"Analyzed","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nmd: Fix missing release of 'active_io' for flush\n\nsubmit_flushes\n atomic_set(&mddev->flush_pending, 1);\n rdev_for_each_rcu(rdev, mddev)\n  atomic_inc(&mddev->flush_pending);\n  bi->bi_end_io = md_end_flush\n  submit_bio(bi);\n                        /* flush io is done first */\n                        md_end_flush\n                         if (atomic_dec_and_test(&mddev->flush_pending))\n                          percpu_ref_put(&mddev->active_io)\n                          -> active_io is not released\n\n if (atomic_dec_and_test(&mddev->flush_pending))\n  -> missing release of active_io\n\nFor consequence, mddev_suspend() will wait for 'active_io' to be zero\nforever.\n\nFix this problem by releasing 'active_io' in submit_flushes() if\n'flush_pending' is decreased to zero.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","score":5.5},"cwes":[],"references":["https://git.kernel.org/stable/c/02dad157ba11064d073f5499dc33552b227d5d3a","https://git.kernel.org/stable/c/11f81438927f84edfaaeb5d5f10856c3a1c1fc82","https://git.kernel.org/stable/c/6b2ff10390b19a2364af622b6666b690443f9f3f","https://git.kernel.org/stable/c/855678ed8534518e2b428bcbcec695de9ba248e8","https://git.kernel.org/stable/c/02dad157ba11064d073f5499dc33552b227d5d3a"],"products":["linux:linux_kernel"],"source":"nvd","synced_at":"2026-10-19T21:49:08.435428910+00:00"},"epss":{"cve":"CVE-2024-27023","score":0.00272,"percentile":0.19553,"date":"2026-11-01"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}