Zhang Wensheng

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** A deadlock issue in the Linux kernel has been identified in the ` device attach` function. The problem arises when the `async schedule dev` function is called within the `device lock`, leading to a potential A-A deadlock. This occurs because ` device attach async helper` also attempts to acquire the `dev` lock, causing a deadlock when memory is low or the work limit is reached. The issue is resolved by moving the `async schedule dev` call outside the `device lock`, allowing for concurrent operations without changing the code logic. **Recommendations** To resolve the issue, apply the patch that moves the `async schedule dev` call outside the `device lock` in the ` device attach` function. This change prevents the deadlock by allowing concurrent operations. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** An issue exists in the block layer support of the Linux kernel within the `block/bfq-iosched.c` module. The `bfq dispatch request()` function contains a use-after-free flaw, which occurs when the system attempts to reuse memory that has already been released. This can be triggered during normal scsi-mq tests, as reported by KASAN (Kernel Address Sanitizer). Exploitation of this issue could allow an attacker to compromise the confidentiality, integrity, and availability of protected information. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.