CVE-2024-53166

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.6

Description A use-after-free vulnerability has been identified in the Linux kernel, specifically in the block, bfq module. The issue arises when the bfq limit depth() function dereferences bfqq from bic without proper locking, potentially leading to a use-after-free condition if the io context is shared among multiple tasks. This vulnerability can be triggered, for example, by testing bfq with io uring in version 6.6 of the Linux kernel. The vulnerability is related to the bfqq group function and can cause a slab-use-after-free error.

Recommendations To resolve this issue, protect the bic to bfqq() function with bfqd->lock. This will prevent the use-after-free condition by ensuring that access to bfqq from bic is properly synchronized.

Note: The provided information does not specify a fixed version for the vulnerability. Therefore, it is recommended to update to the latest version of the Linux kernel to ensure you have the latest security patches.