{
  "schema_version": "1.6.1",
  "id": "RPI-CVE-2024-56641",
  "modified": "2026-10-09T11:39:44Z",
  "upstream": [
    "CVE-2024-56641"
  ],
  "published": "2024-12-27T15:03:32Z",
  "summary": "net/smc: initialize close_work early to avoid warning",
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/smc: initialize close_work early to avoid warning\n\nWe encountered a warning that close_work was canceled before\ninitialization.\n\n  WARNING: CPU: 7 PID: 111103 at kernel/workqueue.c:3047 __flush_work+0x19e/0x1b0\n  Workqueue: events smc_lgr_terminate_work [smc]\n  RIP: 0010:__flush_work+0x19e/0x1b0\n  Call Trace:\n   ? __wake_up_common+0x7a/0x190\n   ? work_busy+0x80/0x80\n   __cancel_work_timer+0xe3/0x160\n   smc_close_cancel_work+0x1a/0x70 [smc]\n   smc_close_active_abort+0x207/0x360 [smc]\n   __smc_lgr_terminate.part.38+0xc8/0x180 [smc]\n   process_one_work+0x19e/0x340\n   worker_thread+0x30/0x370\n   ? process_one_work+0x340/0x340\n   kthread+0x117/0x130\n   ? __kthread_cancel_work+0x50/0x50\n   ret_from_fork+0x22/0x30\n\nThis is because when smc_close_cancel_work is triggered, e.g. the RDMA\ndriver is rmmod and the LGR is terminated, the conn->close_work is\nflushed before initialization, resulting in WARN_ON(!work->func).\n\n__smc_lgr_terminate             | smc_connect_{rdma|ism}\n-------------------------------------------------------------\n                                | smc_conn_create\n\t\t\t\t| \\- smc_lgr_register_conn\nfor conn in lgr->conns_all      |\n\\- smc_conn_kill                |\n   \\- smc_close_active_abort    |\n      \\- smc_close_cancel_work  |\n         \\- cancel_work_sync    |\n            \\- __flush_work     |\n\t         (close_work)   |\n\t                        | smc_close_init\n\t                        | \\- INIT_WORK(&close_work)\n\nSo fix this by initializing close_work before establishing the\nconnection.",
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
    }
  ],
  "affected": [
    {
      "package": {
        "ecosystem": "Raspberry Pi OS:12",
        "name": "linux"
      },
      "versions": [
        "1:6.1.47-1+rpt4"
      ],
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-2712",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v6",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v7",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v7l",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v8",
            "binary_version": "1:6.1.47-1+rpt4"
          }
        ]
      },
      "database_specific": {
        "per_version": {
          "1:6.1.47-1+rpt4": {
            "linux_commit": "655fc658a15ae7a6f37103754adb39ba52a9a14e",
            "upstream_version": "6.1.47",
            "assessment": "commit ancestry (strak rule)",
            "upstream_fixed": null,
            "compiled_filter": false
          }
        }
      }
    }
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-56641"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/f0c37002210aaede10dae849d1a78efc2243add2"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/6638e52dcfafaf1b9cbc34544f0c832db0069ea1"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/0541db8ee32c09463a72d0987382b3a3336b0043"
    }
  ],
  "database_specific": {
    "source": "https://git.kernel.org/pub/scm/linux/security/vulns.git",
    "upstream_modified": "2026-08-05T11:52:36Z",
    "severity": {
      "source": "kernel CNA",
      "cvss_v3_score": 7.5,
      "cvss_v3_severity": "High",
      "scenario": "AV:N - The affected code is the SMC (Shared Memory Communications) protocol connect path, driven entirely by a remote peer's CLC/LLC messages, and the racing link-group teardown is itself triggerable by peer-sent LLC DELETE_LINK(ALL), LLC protocol violations, or a CLC DECLINE with the first-contact flag. No local access to the target is required for the attacking peer.\nAC:L - The remote peer controls both sides of the race \u2014 it dictates when the client executes smc_conn_create() by timing its CLC Accept reply, and it can force __smc_lgr_terminate() at will via an LLC DELETE_LINK ALL or protocol violation \u2014 and it can retry across the many connections an LGR multiplexes until the window is hit.\nPR:N - SMC performs no authentication of its own; a peer completing the ordinary TCP/CLC handshake needs no credentials or privileges on the target system. Locally, AF_SMC socket creation also has no capability check in smc_create()/__smc_create().\nUI:N - The condition is hit during normal, automatic SMC connection establishment and link-group termination handling; no victim action such as opening a file or mounting anything is needed.\nS:U - The warning and any resulting panic occur in the kernel's own SMC/workqueue context, with no crossing of a virtualization, IOMMU, or other security-authority boundary.\nC:N - __flush_work() returns immediately at WARN_ON(!work->func) without dereferencing or exposing any data; there is no out-of-bounds read, uninitialized-memory disclosure, or pointer leak beyond the standard splat.\nI:N - No memory is corrupted \u2014 close_work is zero-initialized and was never queued, so the aborted cancel leaves no dangling state and provides no write primitive or control-flow influence.\nA:H - The WARN_ON is a kernel warning raised from the smc_lgr_terminate_work worker, which panics the system outright on the widely deployed panic_on_warn=1 configuration and can be triggered repeatedly by the peer, yielding a remote denial of service."
    }
  }
}