Use-After-Free Vulnerability in Linux Kernel's BFQ Scheduler

CVE-2022-50329

What is CVE-2022-50329?

A use-after-free vulnerability was identified in the BFQ (Budget Fair Queueing) scheduler within the Linux kernel. The issue arises during the handling of BFQ queues, where a race condition can lead to accessing freed memory. Specifically, the function 'bic_set_bfqq()' may attempt to use the 'bfqq' structure after it has been released by 'bfq_exit_icq_bfqq()', potentially allowing an attacker to manipulate memory and execute arbitrary code. This defect emphasizes the critical importance of proper memory management practices within the kernel.

References