CVE-2024-53166

Summary

CVE-2024-53166 is a Linux kernel vulnerability affecting the block, bfq driver. The issue lies in the function bfq_limit_depth(), which deferences bfqq from bic without the necessary lock, leading to a Use-After-Free (UAF) condition. This vulnerability can be exploited when tasks share an io_context, potentially causing data corruption or denial-of-service. The provided call stack traces indicate that tasks with IDs 808602 and 808589 were involved in the allocation and freeing of the affected bfqq, respectively. The vulnerability can be mitigated by protecting the call to bic_to_bfqq() with bfqd->lock.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.