CVE-2024-49854: block, bfq: fix uaf for accessing waker_bfqq after splitting

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• linux linux kernel5.10.227 and later · before 5.15.168
• linux linux kernel5.16 and later · before 6.1.113
• linux linux kernel6.2 and later · before 6.6.54
• linux linux kernel6.7 and later · before 6.10.13
• linux linux kernel6.11 and later · before 6.11.2

Versions reported by the vendor

Affected version ranges reported by the assigning authority (Linux). Independent of NVD's CPE analysis and usually ahead of it.

• Linux Linux

  • 9e813033594b141f61ff0ef0cfaaef292564b041, 3a5f45a4ad4e1fd36b0a998eef03d76a4f02a2a8, 3630a18846c7853aa326d3b42fd0a855af7b41bcaffected
  • e0c20d88b7dce85d2703bb6ba77bf359959675cd and later · before 63a07379fdb6c72450cb05294461c6016b8b7726affected · git
  • de6c5e3a456019d2182e345730e59721714fa0b5 and later · before de0456460f2abf921e356ed2bd8da87a376680bdaffected · git
  • 19f3bec2ac4be329b9bd12b18a989b867618d2d8 and later · before 0780451f03bf518bc032a7c584de8f92e2d39d7faffected · git
  • 13b3d0e8cb121f99b11918a0d4bcc1ce4647d352 and later · before 0b8bda0ff17156cd3f60944527c9d8c9f99f1583affected · git
  • 4780f50ea50cfe8e89fc3747bf3dd155488433bb and later · before cae58d19121a70329cf971359e2518c93fec04feaffected · git
  • 42c306ed723321af4003b2a41bb73728cab54f85 and later · before 1ba0403ac6447f2d63914fb760c44a3b19c44eafaffected · git
  • 4.19.323 and later · before 4.20affected · semver
  • 5.4.285 and later · before 5.5affected · semver
  • 5.10.227 and later · before 5.11affected · semver

Package-level exposure

OSV and GitHub Advisory data: ecosystem, package and range. SBOM matching uses this table.

Other highest-scoring records for the same primary product.

• CVE-2026-31431crypto: algif_aead - Revert to operating out-of-placeKEV
  90Now
• CVE-2022-0847A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in copy_page_to_iter_pipe…KEV
  89Now
• CVE-2021-22555Heap Out-Of-Bounds Write in Netfilter IP6T_SO_SET_REPLACEKEV
  85Now

Published before and after this one in the same product

• ← EarlierCVE-2024-49852Oct 21, 2024 · scsi: elx: libefc: Fix potential use after free in efc_nport_vport_del()
  31Monitor
• ← EarlierCVE-2024-49853Oct 21, 2024 · firmware: arm_scmi: Fix double free in OPTEE transport
  31Monitor
• Later →CVE-2024-49855Oct 21, 2024 · nbd: fix race between timeout and normal completion
  28Monitor

Root cause

After a memory region is freed, another reference pointing to it is still used. By then, the same region may have been allocated for different data.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1free(dev->buf);2/* ... another thread is still running ... */3process(dev->buf);

1lock(&dev->lock);2free(dev->buf);3dev->buf = NULL;4unlock(&dev->lock);

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.

MITRE has no CAPEC/ATT&CK mapping for this CWE.