Executive Summary

This vulnerability involves a race condition in the Linux kernel related to the function destroy_work_on_stack(). The issue occurs because destroy_work_on_stack() is called after signaling the completion of a work item, creating a race between destroying the work struct and the work struct going out of scope. This can lead to debug object splats and potential instability. The fix involves signaling the work completion only after the work struct has been safely destroyed.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause race conditions that may lead to kernel instability or crashes due to improper handling of work structs in the PCI DOE subsystem. It may affect system reliability and could potentially be exploited to cause denial of service or other unintended behavior in systems using the affected Linux kernel code.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by observing debug object splat messages in the kernel logs indicating a race condition with destroy_work_on_stack(). Look for kernel warnings similar to: 'ODEBUG: free active (active state 0) object' and 'WARNING: CPU: ... at lib/debugobjects.c:514 debug_print_object'. You can check kernel logs using commands like 'dmesg | grep debug_print_object' or 'journalctl -k | grep debug_print_object' to identify these messages.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, ensure that the work struct is destroyed before signaling completion. Specifically, modify the code to signal work completion only after destroy_work_on_stack() has been called, as signaling completion before destroying the work struct creates a race condition. Applying the vendor's patch or updating to a kernel version where this fix is included is recommended.

Useful 0 Not Useful 0