https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 07:26:02 +0000 https://vulnerability.circl.lu/vuln/cve-2024-49854 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>block, bfq: fix uaf for accessing waker_bfqq after splitting</p> <p>After commit 42c306ed7233 (&#34;block, bfq: don&#39;t break merge chain in bfq_split_bfqq()&#34;), if the current procress is the last holder of bfqq, the bfqq can be freed after bfq_split_bfqq(). Hence recored the bfqq and then access bfqq-&gt;waker_bfqq may trigger UAF. What&#39;s more, the waker_bfqq may in the merge chain of bfqq, hence just recored waker_bfqq is still not safe.</p> <p>Fix the problem by adding a helper bfq_waker_bfqq() to check if bfqq-&gt;waker_bfqq is in the merge chain, and current procress is the only holder.</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>block, bfq: fix uaf for accessing waker_bfqq after splitting</p> <p>After commit 42c306ed7233 (&#34;block, bfq: don&#39;t break merge chain in bfq_split_bfqq()&#34;), if the current procress is the last holder of bfqq, the bfqq can be freed after bfq_split_bfqq(). Hence recored the bfqq and then access bfqq-&gt;waker_bfqq may trigger UAF. What&#39;s more, the waker_bfqq may in the merge chain of bfqq, hence just recored waker_bfqq is still not safe.</p> <p>Fix the problem by adding a helper bfq_waker_bfqq() to check if bfqq-&gt;waker_bfqq is in the merge chain, and current procress is the only holder.</p> https://vulnerability.circl.lu/vuln/cve-2024-49854