Kernel: use-after-free after removing device in wb_inode_writeback_end in mm/page-writeback.c

CVE-2024-0562

Summary

A use-after-free flaw exists within the Linux Kernel, particularly triggered during the removal of a disk. This issue occurs when the bdi_unregister function is invoked to halt write-back processes, while still waiting for associated delayed work completion. Consequently, the wb_inode_writeback_end function might schedule bandwidth estimation tasks post-completion, leading to scenarios where a timer attempts to interact with bdi_writeback that has already been freed. This oversight poses risks for system stability and may negatively impact performance.

References