Riskcovery

CVE-2024-0562

Kernel: use-after-free after removing device in wb_inode_writeback_end in mm/page-writeback.c

State
Published
Severity
7.8 High
Published
Jan 15, 2024
Updated
Nov 15, 2025
Reserved
Jan 15, 2024

Read the record on cve.org

Description

A use-after-free flaw was found in the Linux Kernel. When a disk is removed, bdi_unregister is called to stop further write-back and waits for associated delayed work to complete. However, wb_inode_writeback_end() may schedule bandwidth estimation work after this has completed, which can result in the timer attempting to access the recently freed bdi_writeback.

Scores

CVSSScoreVectorSource
3.17.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hredhat

Weaknesses

Affected Products

ProductVersions
kernel
  • before 6.0-rc3Affected
Red Hat Enterprise Linux 8.6 Extended Update SupportRed Hat
  • 0:4.18.0-372.87.1.el8_6 and laterNot affected
Red Hat Virtualization 4 for Red Hat Enterprise Linux 8Red Hat
  • 0:4.18.0-372.87.1.el8_6 and laterNot affected
Red Hat Enterprise Linux 6Red Hat
    Red Hat Enterprise Linux 7Red Hat
      Red Hat Enterprise Linux 7Red Hat
        Red Hat Enterprise Linux 8Red Hat
          Red Hat Enterprise Linux 8Red Hat
            Red Hat Enterprise Linux 9Red Hat
              Red Hat Enterprise Linux 9Red Hat

                References

                Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.