GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2024-49854 (GCVE-0-2024-49854)

Vulnerability from cvelistv5 – Published: 2024-10-21 12:18 – Updated: 2026-08-05 11:40
VLAI
Title
block, bfq: fix uaf for accessing waker_bfqq after splitting
Summary
In the Linux kernel, the following vulnerability has been resolved: block, bfq: fix uaf for accessing waker_bfqq after splitting After commit 42c306ed7233 ("block, bfq: don't break merge chain in bfq_split_bfqq()"), if the current procress is the last holder of bfqq, the bfqq can be freed after bfq_split_bfqq(). Hence recored the bfqq and then access bfqq->waker_bfqq may trigger UAF. What's more, the waker_bfqq may in the merge chain of bfqq, hence just recored waker_bfqq is still not safe. Fix the problem by adding a helper bfq_waker_bfqq() to check if bfqq->waker_bfqq is in the merge chain, and current procress is the only holder.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-10-21 12:56 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: e0c20d88b7dce85d2703bb6ba77bf359959675cd , < 63a07379fdb6c72450cb05294461c6016b8b7726 (git)
Affected: de6c5e3a456019d2182e345730e59721714fa0b5 , < de0456460f2abf921e356ed2bd8da87a376680bd (git)
Affected: 19f3bec2ac4be329b9bd12b18a989b867618d2d8 , < 0780451f03bf518bc032a7c584de8f92e2d39d7f (git)
Affected: 13b3d0e8cb121f99b11918a0d4bcc1ce4647d352 , < 0b8bda0ff17156cd3f60944527c9d8c9f99f1583 (git)
Affected: 4780f50ea50cfe8e89fc3747bf3dd155488433bb , < cae58d19121a70329cf971359e2518c93fec04fe (git)
Affected: 42c306ed723321af4003b2a41bb73728cab54f85 , < 1ba0403ac6447f2d63914fb760c44a3b19c44eaf (git)
Affected: 9e813033594b141f61ff0ef0cfaaef292564b041 (git)
Affected: 3a5f45a4ad4e1fd36b0a998eef03d76a4f02a2a8 (git)
Affected: 3630a18846c7853aa326d3b42fd0a855af7b41bc (git)
Affected: 4.19.323 , < 4.20 (semver)
Affected: 5.4.285 , < 5.5 (semver)
Affected: 5.10.227 , < 5.11 (semver)
guessed Create a notification for this product.
Linux Linux guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-49854",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-21T12:56:32.405058Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-21T13:04:11.371Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T22:22:22.684Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "block/bfq-iosched.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "63a07379fdb6c72450cb05294461c6016b8b7726",
              "status": "affected",
              "version": "e0c20d88b7dce85d2703bb6ba77bf359959675cd",
              "versionType": "git"
            },
            {
              "lessThan": "de0456460f2abf921e356ed2bd8da87a376680bd",
              "status": "affected",
              "version": "de6c5e3a456019d2182e345730e59721714fa0b5",
              "versionType": "git"
            },
            {
              "lessThan": "0780451f03bf518bc032a7c584de8f92e2d39d7f",
              "status": "affected",
              "version": "19f3bec2ac4be329b9bd12b18a989b867618d2d8",
              "versionType": "git"
            },
            {
              "lessThan": "0b8bda0ff17156cd3f60944527c9d8c9f99f1583",
              "status": "affected",
              "version": "13b3d0e8cb121f99b11918a0d4bcc1ce4647d352",
              "versionType": "git"
            },
            {
              "lessThan": "cae58d19121a70329cf971359e2518c93fec04fe",
              "status": "affected",
              "version": "4780f50ea50cfe8e89fc3747bf3dd155488433bb",
              "versionType": "git"
            },
            {
              "lessThan": "1ba0403ac6447f2d63914fb760c44a3b19c44eaf",
              "status": "affected",
              "version": "42c306ed723321af4003b2a41bb73728cab54f85",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "9e813033594b141f61ff0ef0cfaaef292564b041",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "3a5f45a4ad4e1fd36b0a998eef03d76a4f02a2a8",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "3630a18846c7853aa326d3b42fd0a855af7b41bc",
              "versionType": "git"
            },
            {
              "lessThan": "4.20",
              "status": "affected",
              "version": "4.19.323",
              "versionType": "semver"
            },
            {
              "lessThan": "5.5",
              "status": "affected",
              "version": "5.4.285",
              "versionType": "semver"
            },
            {
              "lessThan": "5.11",
              "status": "affected",
              "version": "5.10.227",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "block/bfq-iosched.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux"
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.19.323",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.4.285",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.10.227",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nblock, bfq: fix uaf for accessing waker_bfqq after splitting\n\nAfter commit 42c306ed7233 (\"block, bfq: don\u0027t break merge chain in\nbfq_split_bfqq()\"), if the current procress is the last holder of bfqq,\nthe bfqq can be freed after bfq_split_bfqq(). Hence recored the bfqq and\nthen access bfqq-\u003ewaker_bfqq may trigger UAF. What\u0027s more, the waker_bfqq\nmay in the merge chain of bfqq, hence just recored waker_bfqq is still\nnot safe.\n\nFix the problem by adding a helper bfq_waker_bfqq() to check if\nbfqq-\u003ewaker_bfqq is in the merge chain, and current procress is the only\nholder."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is the BFQ I/O scheduler in the block layer, reached only by submitting I/O locally (read/write/ioctl on a file or block device backed by a bfq-scheduled queue). No network or physical vector exists.\nAC:L - The attacker fully controls both the queue-merge topology and the split trigger by spawning cooperating processes doing interleaved then seeky I/O; this is not a race requiring uncontrolled timing, and syzkaller reproduced the identical UAF with a generic fsstress workload on a default distro-common BFQ configuration.\nPR:L - Any unprivileged local user able to issue ordinary filesystem I/O can reach bfq_init_rq(); no capabilities, root, or namespace tricks are needed.\nUI:N - The attacker\u0027s own processes create the merged/waker queue state and trigger the split; no victim action or interaction is required.\nS:U - The corruption is confined to kernel heap objects within the same security authority; there is no VM, IOMMU, or sandbox boundary crossed.\nC:H - The bug reads a pointer out of a freed bfq_queue slab object, and that value is then dereferenced and propagated; with the freed slot refilled by attacker-created bfq_queues this becomes a controlled kernel-memory read primitive and kernel pointer disclosure.\nI:H - hlist_add_head() writes list pointers into the freed/attacker-influenced waker_bfqq object, and leaves a live queue linked into a dead object\u0027s woken_list that is traversed later \u2014 a write-what-where style primitive leveragable for privilege escalation.\nA:H - The use-after-free reliably produces slab corruption and a kernel oops/panic, as demonstrated by the KASAN slab-use-after-free report from the same code path."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:40:04.538Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/63a07379fdb6c72450cb05294461c6016b8b7726"
        },
        {
          "url": "https://git.kernel.org/stable/c/de0456460f2abf921e356ed2bd8da87a376680bd"
        },
        {
          "url": "https://git.kernel.org/stable/c/0780451f03bf518bc032a7c584de8f92e2d39d7f"
        },
        {
          "url": "https://git.kernel.org/stable/c/0b8bda0ff17156cd3f60944527c9d8c9f99f1583"
        },
        {
          "url": "https://git.kernel.org/stable/c/cae58d19121a70329cf971359e2518c93fec04fe"
        },
        {
          "url": "https://git.kernel.org/stable/c/1ba0403ac6447f2d63914fb760c44a3b19c44eaf"
        }
      ],
      "title": "block, bfq: fix uaf for accessing waker_bfqq after splitting",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-49854",
    "datePublished": "2024-10-21T12:18:46.723Z",
    "dateReserved": "2024-10-21T12:17:06.016Z",
    "dateUpdated": "2026-08-05T11:40:04.538Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-49854",
      "date": "2026-09-16",
      "epss": "0.00217",
      "percentile": "0.12286"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.10.227\", \"versionEndExcluding\": \"5.15.168\", \"matchCriteriaId\": \"A18D7AFF-3C9E-46FF-B2A9-3CEB860CD094\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.16\", \"versionEndExcluding\": \"6.1.113\", \"matchCriteriaId\": \"D01BD22E-ACD1-4618-9D01-6116570BE1EE\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.2\", \"versionEndExcluding\": \"6.6.54\", \"matchCriteriaId\": \"D448821D-C085-4CAF-88FA-2DDE7BE21976\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.7\", \"versionEndExcluding\": \"6.10.13\", \"matchCriteriaId\": \"CE94BB8D-B0AB-4563-9ED7-A12122B56EBE\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.11\", \"versionEndExcluding\": \"6.11.2\", \"matchCriteriaId\": \"AB755D26-97F4-43B6-8604-CD076811E181\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nblock, bfq: fix uaf for accessing waker_bfqq after splitting\\n\\nAfter commit 42c306ed7233 (\\\"block, bfq: don\u0027t break merge chain in\\nbfq_split_bfqq()\\\"), if the current procress is the last holder of bfqq,\\nthe bfqq can be freed after bfq_split_bfqq(). Hence recored the bfqq and\\nthen access bfqq-\u003ewaker_bfqq may trigger UAF. What\u0027s more, the waker_bfqq\\nmay in the merge chain of bfqq, hence just recored waker_bfqq is still\\nnot safe.\\n\\nFix the problem by adding a helper bfq_waker_bfqq() to check if\\nbfqq-\u003ewaker_bfqq is in the merge chain, and current procress is the only\\nholder.\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: bloqueo, bfq: arregle uaf por acceder waker_bfqq despues de separar Despu\\u00e9s de el commit 42c306ed7233 (\\\"block, bfq: don\u0027t break merge chain in bfq_split_bfqq()\\\"), si el proceso actual es el \\u00faltimo contenedor de bfqq, el bfqq se puede liberar despu\\u00e9s de bfq_split_bfqq(). Por lo tanto, grabar el bfqq y luego acceder a bfqq-\u0026gt;waker_bfqq puede activar UAF. Adem\\u00e1s, waker_bfqq puede estar en la cadena de fusi\\u00f3n de bfqq, por lo tanto, grabar solo waker_bfqq sigue sin ser seguro. Solucione el problema a\\u00f1adiendo un ayudante bfq_waker_bfqq() para comprobar si bfqq-\u0026gt;waker_bfqq est\\u00e1 en la cadena de fusi\\u00f3n y el proceso actual es el \\u00fanico contenedor.\"}]",
      "id": "CVE-2024-49854",
      "lastModified": "2024-10-23T16:29:32.857",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 5.9}]}",
      "published": "2024-10-21T13:15:06.203",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/0780451f03bf518bc032a7c584de8f92e2d39d7f\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/0b8bda0ff17156cd3f60944527c9d8c9f99f1583\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/1ba0403ac6447f2d63914fb760c44a3b19c44eaf\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/63a07379fdb6c72450cb05294461c6016b8b7726\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/cae58d19121a70329cf971359e2518c93fec04fe\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/de0456460f2abf921e356ed2bd8da87a376680bd\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Analyzed",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-416\"}]}]"
    },
    "microsoft_vex": {
      "current_release_date": "2026-02-18T02:09:01.000Z",
      "cve": "CVE-2024-49854",
      "id": "msrc_CVE-2024-49854",
      "initial_release_date": "2024-10-01T07:00:00.000Z",
      "product_status:fixed": "5",
      "product_status:known_affected": "5",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "block bfq: fix uaf for accessing waker_bfqq after splitting",
      "url": "https://msrc.microsoft.com/csaf/vex/2024/msrc_cve-2024-49854.json",
      "version": "3"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-49854\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-10-21T13:15:06.203\",\"lastModified\":\"2026-08-04T11:20:50.910\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nblock, bfq: fix uaf for accessing waker_bfqq after splitting\\n\\nAfter commit 42c306ed7233 (\\\"block, bfq: don\u0027t break merge chain in\\nbfq_split_bfqq()\\\"), if the current procress is the last holder of bfqq,\\nthe bfqq can be freed after bfq_split_bfqq(). Hence recored the bfqq and\\nthen access bfqq-\u003ewaker_bfqq may trigger UAF. What\u0027s more, the waker_bfqq\\nmay in the merge chain of bfqq, hence just recored waker_bfqq is still\\nnot safe.\\n\\nFix the problem by adding a helper bfq_waker_bfqq() to check if\\nbfqq-\u003ewaker_bfqq is in the merge chain, and current procress is the only\\nholder.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: bloqueo, bfq: arregle uaf por acceder waker_bfqq despues de separar Despu\u00e9s de el commit 42c306ed7233 (\\\"block, bfq: don\u0027t break merge chain in bfq_split_bfqq()\\\"), si el proceso actual es el \u00faltimo contenedor de bfqq, el bfqq se puede liberar despu\u00e9s de bfq_split_bfqq(). Por lo tanto, grabar el bfqq y luego acceder a bfqq-\u0026gt;waker_bfqq puede activar UAF. Adem\u00e1s, waker_bfqq puede estar en la cadena de fusi\u00f3n de bfqq, por lo tanto, grabar solo waker_bfqq sigue sin ser seguro. Solucione el problema a\u00f1adiendo un ayudante bfq_waker_bfqq() para comprobar si bfqq-\u0026gt;waker_bfqq est\u00e1 en la cadena de fusi\u00f3n y el proceso actual es el \u00fanico contenedor.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"block/bfq-iosched.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"e0c20d88b7dce85d2703bb6ba77bf359959675cd\",\"lessThan\":\"63a07379fdb6c72450cb05294461c6016b8b7726\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"de6c5e3a456019d2182e345730e59721714fa0b5\",\"lessThan\":\"de0456460f2abf921e356ed2bd8da87a376680bd\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"19f3bec2ac4be329b9bd12b18a989b867618d2d8\",\"lessThan\":\"0780451f03bf518bc032a7c584de8f92e2d39d7f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"13b3d0e8cb121f99b11918a0d4bcc1ce4647d352\",\"lessThan\":\"0b8bda0ff17156cd3f60944527c9d8c9f99f1583\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4780f50ea50cfe8e89fc3747bf3dd155488433bb\",\"lessThan\":\"cae58d19121a70329cf971359e2518c93fec04fe\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"42c306ed723321af4003b2a41bb73728cab54f85\",\"lessThan\":\"1ba0403ac6447f2d63914fb760c44a3b19c44eaf\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"9e813033594b141f61ff0ef0cfaaef292564b041\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"3a5f45a4ad4e1fd36b0a998eef03d76a4f02a2a8\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"3630a18846c7853aa326d3b42fd0a855af7b41bc\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4.19.323\",\"lessThan\":\"4.20\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"5.4.285\",\"lessThan\":\"5.5\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"5.10.227\",\"lessThan\":\"5.11\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"block/bfq-iosched.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\"}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-10-21T12:56:32.405058Z\",\"id\":\"CVE-2024-49854\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.10.227\",\"versionEndExcluding\":\"5.15.168\",\"matchCriteriaId\":\"A18D7AFF-3C9E-46FF-B2A9-3CEB860CD094\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.113\",\"matchCriteriaId\":\"D01BD22E-ACD1-4618-9D01-6116570BE1EE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.54\",\"matchCriteriaId\":\"D448821D-C085-4CAF-88FA-2DDE7BE21976\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.10.13\",\"matchCriteriaId\":\"CE94BB8D-B0AB-4563-9ED7-A12122B56EBE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.11\",\"versionEndExcluding\":\"6.11.2\",\"matchCriteriaId\":\"AB755D26-97F4-43B6-8604-CD076811E181\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0780451f03bf518bc032a7c584de8f92e2d39d7f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/0b8bda0ff17156cd3f60944527c9d8c9f99f1583\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/1ba0403ac6447f2d63914fb760c44a3b19c44eaf\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/63a07379fdb6c72450cb05294461c6016b8b7726\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/cae58d19121a70329cf971359e2518c93fec04fe\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/de0456460f2abf921e356ed2bd8da87a376680bd\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-13T10:04:12+00:00",
      "cve": "CVE-2024-49854",
      "id": "CVE-2024-49854",
      "initial_release_date": "2024-10-21T00:00:00+00:00",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: block, bfq: fix uaf for accessing waker_bfqq after splitting",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-49854.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-09-13T23:43:06Z",
      "cve": "CVE-2024-49854",
      "id": "CVE-2024-49854",
      "initial_release_date": "2024-10-21T15:45:43Z",
      "product_status:known_affected": "394",
      "product_status:known_not_affected": "443",
      "product_status:recommended": "286",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-49854",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-49854.json",
      "version": "65"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-11-03T22:22:22.684Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-49854\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-10-21T12:56:32.405058Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-10-21T12:56:35.571Z\"}}], \"cna\": {\"title\": \"block, bfq: fix uaf for accessing waker_bfqq after splitting\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"e0c20d88b7dce85d2703bb6ba77bf359959675cd\", \"lessThan\": \"63a07379fdb6c72450cb05294461c6016b8b7726\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"de6c5e3a456019d2182e345730e59721714fa0b5\", \"lessThan\": \"de0456460f2abf921e356ed2bd8da87a376680bd\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"19f3bec2ac4be329b9bd12b18a989b867618d2d8\", \"lessThan\": \"0780451f03bf518bc032a7c584de8f92e2d39d7f\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"13b3d0e8cb121f99b11918a0d4bcc1ce4647d352\", \"lessThan\": \"0b8bda0ff17156cd3f60944527c9d8c9f99f1583\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"4780f50ea50cfe8e89fc3747bf3dd155488433bb\", \"lessThan\": \"cae58d19121a70329cf971359e2518c93fec04fe\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"42c306ed723321af4003b2a41bb73728cab54f85\", \"lessThan\": \"1ba0403ac6447f2d63914fb760c44a3b19c44eaf\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"9e813033594b141f61ff0ef0cfaaef292564b041\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"3a5f45a4ad4e1fd36b0a998eef03d76a4f02a2a8\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"3630a18846c7853aa326d3b42fd0a855af7b41bc\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"4.19.323\", \"lessThan\": \"4.20\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"5.4.285\", \"lessThan\": \"5.5\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"5.10.227\", \"lessThan\": \"5.11\", \"versionType\": \"semver\"}], \"programFiles\": [\"block/bfq-iosched.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"programFiles\": [\"block/bfq-iosched.c\"], \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/63a07379fdb6c72450cb05294461c6016b8b7726\"}, {\"url\": \"https://git.kernel.org/stable/c/de0456460f2abf921e356ed2bd8da87a376680bd\"}, {\"url\": \"https://git.kernel.org/stable/c/0780451f03bf518bc032a7c584de8f92e2d39d7f\"}, {\"url\": \"https://git.kernel.org/stable/c/0b8bda0ff17156cd3f60944527c9d8c9f99f1583\"}, {\"url\": \"https://git.kernel.org/stable/c/cae58d19121a70329cf971359e2518c93fec04fe\"}, {\"url\": \"https://git.kernel.org/stable/c/1ba0403ac6447f2d63914fb760c44a3b19c44eaf\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nblock, bfq: fix uaf for accessing waker_bfqq after splitting\\n\\nAfter commit 42c306ed7233 (\\\"block, bfq: don\u0027t break merge chain in\\nbfq_split_bfqq()\\\"), if the current procress is the last holder of bfqq,\\nthe bfqq can be freed after bfq_split_bfqq(). Hence recored the bfqq and\\nthen access bfqq-\u003ewaker_bfqq may trigger UAF. What\u0027s more, the waker_bfqq\\nmay in the merge chain of bfqq, hence just recored waker_bfqq is still\\nnot safe.\\n\\nFix the problem by adding a helper bfq_waker_bfqq() to check if\\nbfqq-\u003ewaker_bfqq is in the merge chain, and current procress is the only\\nholder.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"4.19.323\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"5.4.285\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"5.10.227\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-05-23T15:53:56.417Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-49854\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-05-23T15:53:56.417Z\", \"dateReserved\": \"2024-10-21T12:17:06.016Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-10-21T12:18:46.723Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.