{"id":"CVE-2024-41023","title":"sched/deadline: Fix task_struct reference leak","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nsched/deadline: Fix task_struct reference leak\n\nDuring the execution of the following stress test with linux-rt:\n\nstress-ng --cyclic 30 --timeout 30 --minimize --quiet\n…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= feff2e65efd8d84cf831668e182b2ce73c604bbb < f8005214946fd1d9fefdeff19c6ce46d60de2cef","Linux >= feff2e65efd8d84cf831668e182b2ce73c604bbb < 7a54d31face626f62de415ebe77b43f76c3ffaf4","Linux >= feff2e65efd8d84cf831668e182b2ce73c604bbb < b58652db66c910c2245f5bee7deca41c12d707b9","Linux f0e1c1d8ff908a39dd42e723d08f104505dfa601","Linux 184c8ab5342450c4ae6fc5d937f9bb06c620dcf1","Linux >= 4.19.257 < 4.20","Linux >= 5.4.212 < 5.5","Linux 5.10"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2024-09-10T16:24:19.073103Z"},"published":"2024-07-29","updated":"2026-10-21","sourceUpdated":"2026-10-21T12:34:54.743Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2024-41023","references":[{"url":"https://git.kernel.org/stable/c/f8005214946fd1d9fefdeff19c6ce46d60de2cef"},{"url":"https://git.kernel.org/stable/c/7a54d31face626f62de415ebe77b43f76c3ffaf4"},{"url":"https://git.kernel.org/stable/c/b58652db66c910c2245f5bee7deca41c12d707b9"}],"tags":["cve.org"],"epss":0.00293,"epssPercentile":0.20689,"ingestedAt":"2026-10-21T12:48:53.735Z","slug":"CVE-2024-41023","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nsched/deadline: Fix task_struct reference leak\n\nDuring the execution of the following stress test with linux-rt:\n\nstress-ng --cyclic 30 --timeout 30 --minimize --quiet\n\nkmemleak frequently reported a memory leak concerning the task_struct:\n\nunreferenced object 0xffff8881305b8000 (size 16136):\n  comm \"stress-ng\", pid 614, jiffies 4294883961 (age 286.412s)\n  object hex dump (first 32 bytes):\n    02 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00  .@..............\n    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................\n  debug hex dump (first 16 bytes):\n    53 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00  S...............\n  backtrace:\n    [<00000000046b6790>] dup_task_struct+0x30/0x540\n    [<00000000c5ca0f0b>] copy_process+0x3d9/0x50e0\n    [<00000000ced59777>] kernel_clone+0xb0/0x770\n    [<00000000a50befdc>] __do_sys_clone+0xb6/0xf0\n    [<000000001dbf2008>] do_syscall_64+0x5d/0xf0\n    [<00000000552900ff>] entry_SYSCALL_64_after_hwframe+0x6e/0x76\n\nThe issue occurs in start_dl_timer(), which increments the task_struct\nreference count and sets a timer. The timer callback, dl_task_timer,\nis supposed to decrement the reference count upon expiration. However,\nif enqueue_task_dl() is called before the timer expires and cancels it,\nthe reference count is not decremented, leading to the leak.\n\nThis patch fixes the reference leak by ensuring the task_struct\nreference count is properly decremented when the timer is canceled.\n\n## Affected\n\n- `Linux >= feff2e65efd8d84cf831668e182b2ce73c604bbb < f8005214946fd1d9fefdeff19c6ce46d60de2cef`\n- `Linux >= feff2e65efd8d84cf831668e182b2ce73c604bbb < 7a54d31face626f62de415ebe77b43f76c3ffaf4`\n- `Linux >= feff2e65efd8d84cf831668e182b2ce73c604bbb < b58652db66c910c2245f5bee7deca41c12d707b9`\n- `Linux f0e1c1d8ff908a39dd42e723d08f104505dfa601`\n- `Linux 184c8ab5342450c4ae6fc5d937f9bb06c620dcf1`\n- `Linux >= 4.19.257 < 4.20`\n- `Linux >= 5.4.212 < 5.5`\n- `Linux 5.10`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}