CVE-2024-42149

In the Linux kernel, the following vulnerability has been resolved: fs: don't misleadingly warn during thaw operations The block device may have been frozen before it was claimed by a filesystem. Concurrently another process might try to mount that frozen block device and has temporarily claimed the block device for that purpose causing a concurrent fs_bdev_thaw() to end up here. The mounter is already about to abort mounting because they still saw an elevanted bdev->bd_fsfreeze_count so get_bdev_super() will return NULL in that case. For example, P1 calls dm_suspend() which calls into bdev_freeze() before the block device has been claimed by the filesystem. This brings bdev->bd_fsfreeze_count to 1 and no call into fs_bdev_freeze() is required. Now P2 tries to mount that frozen block device. It claims it and checks bdev->bd_fsfreeze_count. As it's elevated it aborts mounting. In the meantime P3 called dm_resume(). P3 sees that the block device is already claimed by a filesystem and calls into fs_bdev_thaw(). P3 takes a passive reference and realizes that the filesystem isn't ready yet. P3 puts itself to sleep to wait for the filesystem to become ready. P2 now puts the last active reference to the filesystem and marks it as dying. P3 gets woken, sees that the filesystem is dying and get_bdev_super() fails.

• CWE-476

• https://git.kernel.org/stable/c/25b1e3906e050d452427bc51620bb7f0a591373aPatch
• https://git.kernel.org/stable/c/2ae4db5647d807efb6a87c09efaa6d1db9c905d7Patch
• https://git.kernel.org/stable/c/25b1e3906e050d452427bc51620bb7f0a591373aPatch
• https://git.kernel.org/stable/c/2ae4db5647d807efb6a87c09efaa6d1db9c905d7Patch

Published

Jul 30, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-42143Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2024-42144In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2024-42145In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2024-42146In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2024-42147In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2024-42148In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2024-4215pgAdmin <= 8.5 is affected by a multi-factor authentication …8.8
• CVE-2024-42150In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2024-42151In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2024-42152In the Linux kernel, the following vulnerability has been re…4.7
• CVE-2024-42153In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2024-42154In the Linux kernel, the following vulnerability has been re…4.4