CVE-2024-42294 is a vulnerability identified in the Linux kernel related to a deadlock condition occurring between the functions sd_remove and sd_release within the block device subsystem. The issue manifests as a classic ABBA deadlock involving the acquisition of the disk's open_mutex lock after freezing the block queue. Specifically, the deadlock arises because the SCSI subsystem does not set the GD_OWNS_QUEUE flag, which means the QUEUE_FLAG_DYING is not set in this scenario. Consequently, when the system attempts to remove or release SCSI devices, the kernel threads become blocked waiting on mutexes that are held by each other, causing hung tasks and system stalls. The provided kernel log traces show tasks such as "kworker/0:0" and "fsck." being blocked for extended periods (over 188 seconds), indicating significant system unresponsiveness. The deadlock occurs during device removal and release operations, particularly involving SCSI devices and USB storage disconnects, which can freeze the system or delay critical I/O operations. The root cause is the improper ordering of lock acquisition and queue freezing, which the patch aims to fix by ensuring the disk's open_mutex is not acquired after the queue is frozen. This vulnerability affects Linux kernel versions identified by the commit hash eec1be4c30df73238b936fa9f3653773a6f8b15c and likely other related versions before the patch. No known exploits in the wild have been reported yet, and no CVSS score has been assigned at the time of publication.

For European organizations, this vulnerability can lead to system instability and denial of service conditions on Linux servers and devices that manage SCSI or USB storage devices. The deadlock can cause critical system processes to hang, potentially leading to downtime of services relying on affected Linux systems. This is particularly impactful for data centers, cloud providers, and enterprises using Linux-based infrastructure for storage management, virtual machines, or container orchestration. The inability to properly remove or release storage devices can disrupt maintenance operations and automated workflows, increasing operational risks. In environments with high storage I/O demands, such as financial institutions, research centers, or telecommunications providers, this could degrade performance or cause outages. Although no direct data breach or privilege escalation is indicated, the availability impact alone can have significant business consequences, including loss of productivity and potential SLA violations. The impact is heightened in environments where Linux kernels are customized or updated infrequently, as unpatched systems remain vulnerable to these deadlocks.

To mitigate this vulnerability, European organizations should prioritize applying the official Linux kernel patches that address the deadlock between sd_remove and sd_release. Kernel updates should be tested and deployed promptly, especially on systems handling critical storage operations. Organizations should audit their Linux kernel versions to identify affected systems using the specified commit hashes or kernel versions known to contain this issue. For environments where immediate patching is not feasible, temporary mitigation could include minimizing device removal operations or USB storage disconnects during peak operational hours to reduce the risk of triggering the deadlock. Monitoring kernel logs for hung tasks or blocked processes related to block device operations can help detect early signs of the issue. Additionally, organizations should review their storage device management procedures and consider implementing redundancy or failover mechanisms to maintain availability during maintenance windows. Coordination with hardware vendors and Linux distribution maintainers is recommended to ensure timely updates and support.