CVE-2024-50127

net: sched: fix use-after-free in taprio_change()

State: Published
Severity: 7.8 High
Published: Nov 5, 2024
Updated: Oct 15, 2026
Reserved: Oct 21, 2024

Description

In the Linux kernel, the following vulnerability has been resolved:

net: sched: fix use-after-free in taprio_change()

In 'taprio_change()', 'admin' pointer may become dangling due to sched switch / removal caused by 'advance_sched()', and critical section protected by 'q->current_entry_lock' is too small to prevent from such a scenario (which causes use-after-free detected by KASAN). Fix this by prefer 'rcu_replace_pointer()' over 'rcu_assign_pointer()' to update 'admin' immediately before an attempt to schedule freeing.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	CISA-ADP

Weaknesses

CWE-416 Use After Free

Affected Products

Product	Versions
LinuxLinux	a3d43c0d56f1b94e74963a2fbadfb70126d92213 to before 2f868ce6013548a713c431c679ef73747a66fcf3Affected a3d43c0d56f1b94e74963a2fbadfb70126d92213 to before 8a283a19026aaae8a773fd8061263cfa315b127fAffected a3d43c0d56f1b94e74963a2fbadfb70126d92213 to before 999612996df28d81f163dad530d7f8026e03aec6Affected a3d43c0d56f1b94e74963a2fbadfb70126d92213 to before fe371f084073e8672a2d7d46b335c3c060d1e301Affected a3d43c0d56f1b94e74963a2fbadfb70126d92213 to before 0d4c0d2844e4eac3aed647f948fd7e60eea56a61Affected a3d43c0d56f1b94e74963a2fbadfb70126d92213 to before 2240f9376f20f8b6463232b4ca7292569217237fAffected a3d43c0d56f1b94e74963a2fbadfb70126d92213 to before f504465970aebb2467da548f7c1efbbf36d0f44bAffected
LinuxLinux	5.2Affected before 5.2Not affected 5.4.285 through 5.4.Not affected 5.10.229 through 5.10.Not affected 5.15.170 through 5.15.Not affected 6.1.115 through 6.1.Not affected 6.6.59 through 6.6.Not affected 6.11.6 through 6.11.Not affected 6.12 and laterNot affected

Product

Versions

LinuxLinux

a3d43c0d56f1b94e74963a2fbadfb70126d92213 to before 2f868ce6013548a713c431c679ef73747a66fcf3Affected
a3d43c0d56f1b94e74963a2fbadfb70126d92213 to before 8a283a19026aaae8a773fd8061263cfa315b127fAffected
a3d43c0d56f1b94e74963a2fbadfb70126d92213 to before 999612996df28d81f163dad530d7f8026e03aec6Affected
a3d43c0d56f1b94e74963a2fbadfb70126d92213 to before fe371f084073e8672a2d7d46b335c3c060d1e301Affected
a3d43c0d56f1b94e74963a2fbadfb70126d92213 to before 0d4c0d2844e4eac3aed647f948fd7e60eea56a61Affected
a3d43c0d56f1b94e74963a2fbadfb70126d92213 to before 2240f9376f20f8b6463232b4ca7292569217237fAffected
a3d43c0d56f1b94e74963a2fbadfb70126d92213 to before f504465970aebb2467da548f7c1efbbf36d0f44bAffected

LinuxLinux

5.2Affected
before 5.2Not affected
5.4.285 through 5.4.*Not affected
5.10.229 through 5.10.*Not affected
5.15.170 through 5.15.*Not affected
6.1.115 through 6.1.*Not affected
6.6.59 through 6.6.*Not affected
6.11.6 through 6.11.*Not affected
6.12 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.